DATA PRIVACY NOTICE

THIS PRIVACY POLICY CONTAINS IMPORTANT TERMS THAT AFFECT YOUR LEGAL RIGHTS.

MR Angel Credit Corp.(“we” or “us” or “MRACC”) respects and values your privacy and employs reasonable measures to protect your Personal Data in accordance with Republic Act No. 10173 or the Data Privacy Act of 2012, its Implementing Rules and Regulations, and related issuances from the National Privacy Commission (collectively, “DPA”).

MRACC recognizes the importance of protecting information collected from users and has adopted this privacy notice to inform users about how MRACC collects, uses, stores, transfers/discloses, and disposes information derived from their use of MRACC products, services, sites, and online portals. By clicking “I agree” to the terms and conditions of this Data Privacy Notice, you certify that you have read and understood, and agree to, the terms of this Notice.

  1. Personal Data Collected

    MRACC collects the following personal information and sensitive personal information (“Personal Data”):

    1. Personal Details such as but not limited to name, current address, provincial address, updated contact details, birthdate, gender, civil status, citizenship, signature and other requirements to establish identity;
    2. Any Government-Issued Identification that you may submit and the data contained therein, such as but not limited to SSS/GSIS ID, Tax Identification Number Card, PhilHealth Card, PAG-IBIG Card, UMID;
    3. Employment details such as but not limited to status of employment, nature of work, source of income, payroll details, and employment ID;
    4. Loan details, including loan amount and payment terms;
    5. Names and Contact Details of your character references;
    6. Any other information that your employer and MRACC may require in processing your enrollment and loan.

  2. Method of Collection and Processing

    We collect your Personal Data from any documents or communications that you may submit to us either through your employer or directly to any of our authorized representatives. We may also collect your Personal Data through the following methods:

    1. Registration on the QLO platform;
    2. Submission of the online loan application form;
    3. Communication with MRACC representatives;
    4. Credit reports;
    5. Navigation of the QLO platform.

    In this regard, you expressly authorize your employer to collect your Personal Data and share such Personal Data to us for the Permitted Purposes described in this Notice. Your employer shall create your account on the QLO platform should you decide to avail of our loan facilities.

    You may inform us of the specific Personal Data you do not want to be processed beyond the Permitted Purposes. We will respect your request in so far as it is feasible to fulfill the purposes for which the Personal Data was collected.

    Where you have provided us with the Personal Data of individuals other than yourself, you warrant that you have obtained their consent for the disclosure, in accordance with the Data Privacy Act of 2012.

  3. Method of Processing

    Your personal data may be processed by MRACC both by way of computer media and on paper, as well as through our SMS Broadcast application. Your personal data shall be used by the SMS Broadcast application for billing and account management, identity verification, product development, promotions, generation of orders to pay, loan status, and other MRACC services. All methods of processing shall be done in compliance with the rules issued by the National Privacy Commission in relation to personal data protection.

  4. Lawful Basis and Purposes for Processing

    The processing of your Personal Data is based on the following lawful bases for processing Personal Data under the Data Privacy Act of 2012:

    1. To comply with MRACC’s obligation to conduct Know-Your-Customer procedures, as required under the Anti-Money Laundering Act of 2001;
    2. To comply with MRACC’s obligation to submit credit data to the Credit Information Corporation under the Credit Information System Act;
    3. To assess your eligibility for a loan prior to entering into a loan contract with MRACC;
    4. To fulfill MRACC’s obligations under the loan contract;
    5. Where applicable, to protect the lawful rights and interests of MRACC in court proceedings, and the establishment, exercise or defense of legal claims;
    6. Other legitimate interests of MRACC, including the prevention and investigation of fraud, information security, systems maintenance, and customer service.

    Moreover, you explicitly consent that your Personal Data shall be processed for the following purposes (the “Permitted Purposes”):

    1. To conduct Know-Your-Customer procedures as required by law;
    2. To evaluate your eligibility for availment of loan facilities from MRACC;
    3. To communicate with you regarding your loan, which may be done through any of the communication lines you have provided;
    4. If approved, to process the release of your loan;
    5. To provide updates on your account, enrollment, loan application or loan payment status;
    6. To create your account on the QLO platform;
    7. To conduct profiling activities, including customer behavior analysis, the creation of your credit history profile and credit score;
    8. To provide updates and promotional campaigns on MRACC’s products and service, and those of its partner companies;
    9. To collect on amounts due on the loans and enforce the terms of the loan agreement;
    10. To monitor and enforce compliance with the employer’s policies and procedures;
    11. To enforce closure and termination of your account;
    12. To conduct audits or investigate a complaint or security threat;
    13. To perform system administration and maintenance;
    14. To assess and improve the services of MRACC;
    15. To comply with statutory and regulatory requirements, including directives, issuances by, or obligations of MRACC to any competent authority, regulator, supervisory body, enforcement agency, exchange, court, quasi-judicial body or tribunal;
    16. To enable MRACC to exercise sound corporate governance over its businesses, ensure that risks arising therefrom are duly identified, measured, managed and mitigated, and enhance risk assessment and prevent fraud;
    17. To establish, exercise, or defend legal claims;
    18. Any other purposes that may be allowed by law; and
    19. To fulfill any other purposes directly related to the above-stated purposes.

    MRACC will not process your information in ways incompatible with the above-stated purposes.

  5. Personal Information Controller

    MRACC is the operator of the QLO platform and is the Personal Information Controller under the DPA, which means that it determines what purposes the Personal Data it holds will be used for. It may also be that your Personal Data is disclosed to third parties pursuant to a data sharing agreement, in which case such third parties are also the personal information controllers of your Personal Data.

  6. Transfers and Disclosures

    Your Personal Data may be disclosed to our partners and third parties for the following purposes:

    1. To facilitate the processing of the payroll and collection;
    2. To facilitate identity verification and servicing of loan account;
    3. To respond to law enforcement authority or other government regulatory bodies’ requests;
    4. To prevent physical harm or financial loss;
    5. To conduct audits, including operational, risk, compliance, financial, and anti-fraud and corruption audits, and/or investigate a complaint or security threat;
    6. To comply with the Company’s business and management responsibilities and policies, which are necessary for the organizational functioning of the Company;
    7. To comply with statutory requirements
    8. To establish, exercise, or defend legal claims; and
    9. Fulfill any other purposes directly related to the above-stated purposes.

    When the processing of your Personal Data is outsourced or shared to a third party, the processing will be subject to written agreements between MRACC and the third parties processing the data. These written agreements specify the rights and obligations of each party and will provide that the third party has adequate security measures in place and will only process your personal information on the specific written instructions of MRACC. You may request a copy of our agreements with the third party by contacting us; provided any confidential information pertaining to the trade secrets or business operations shall be redacted.

    MRACC may also transfer your Personal Data to third parties as required by law or legal instrument, to protect its rights or assets, to facilitate acquisition or disposition of its business, and in emergencies where the health or safety of a person is endangered.

    MRACC will not sell, rent, share, trade, or disclose any of your Personal Data to any other party without your prior written consent, with the exception of entities within MRACC and any third-party service providers which MRACC has engaged, whose services necessarily require the processing of your Personal Data.

    The following are the third parties to whom your Personal Data may be disclosed:

    1. Your current employer
    2. Your future employer who has contracted MRACC as its salary loan service provider
    3. Company affiliates and subsidiaries
    4. Regulatory bodies/agencies and other legal bodies, including the Bangko Sentral ng Pilipinas, the Credit Information Corporation, the National Privacy Commission, among others.
    5. Third-party service providers and suppliers
    6. Stockholders and business partners
    7. Potential investors

  7. Data Retention

    Your Personal Data shall be retained of MRACC for as long as either of the following circumstances are present:

    1. You maintain an active account on the QLO online loan application platform;
    2. Your employer maintains its partnership with MRACC as its salary loan service provider;
    3. You have an outstanding balance on your loan.

    MRACC will retain and use your Personal Data as necessary to comply with its legal obligations, resolve disputes, and enforce its agreements:

    1. Hardcopies of the forms you have submitted, as well as all records relevant to your application may be stored in our premises in a secure cabinet/storeroom or in an off-site warehouse managed by a third-party service provider.
    2. Digitally processed data shall be stored in our information management system hosted on-site or in the premises of an authorized third-party services provider.
    3. MRACC shall ensure, using contractual and other reasonable means, that the third-party service provider implements proper safeguards to ensure the confidentiality, integrity and availability of the Personal Data processed, prevent its use for unauthorized purposes, and comply with the requirements of the DPA.

    Any Personal Data collected by the MRACC shall be anonymized for use in customer behavior analysis, system administration, service quality maintenance, and customer service or support improvement.

    Any identifying data shall be deleted from the QLO online loans application platform within 3 years from the occurrence of either of the following circumstances:

    1. Termination of partnership between your employer and MRACC, and full settlement of your outstanding loans payable.
    2. When your employer tags you as “resigned/separated” on the platform and you have fully settled your outstanding loans payable.

    Such data shall be deleted immediately and cannot be recovered by any users or MRACC employees after this point. Data which has been deleted or otherwise destroyed cannot be recovered at any time.

  8. Data Protection Measures

    MRACC has put in place physical, electronic, and managerial procedures that are in consonance with reasonable industry standards to help prevent unauthorized access, maintain data security, and ensure proper handling of your Personal Data. These safeguards vary based on the sensitivity of the information that we collect and store.

  9. Data Subject Rights

    You have the following rights under the DPA, which you may exercise at your discretion:

    1. The right to access personal information

      Subject access requests may be made by emailing the data protection officer. MRACC may take reasonable steps to confirm the requestor’s identity as a data subject before granting access to the Personal Data and allowing updates thereto.

    2. The right to make corrections to personal information

      The DPA requires the personal information controller to take reasonable steps to ensure that any personal data it processes is accurate and up-to-date. It is your responsibility to inform us of any changes to the personal information that you have supplied to us during the course of your engagement.

    3. The right to object to the processing of personal information

      You have the right to object to the processing of your Personal Data, including processing for direct marketing, automated processing or profiling. You shall also be notified and be given an opportunity to withhold consent to the processing in case of changes or any amendment to the information supplied or declared to you in this Data Privacy Notice. Please note that some of the personal data you have provided to us is necessary for us to comply with statutory and regulatory requirements, as well as the Company’s administrative policies and is thus mandatorily required to be collected and processed. Withholding of your consent to the processing of certain personal data may prevent you from availing of certain benefits.

    4. The right to erasure or blocking of personal information

      You have the right to suspend, withdraw or order the blocking, removal or destruction of your Personal Data from our filing system.

    5. The right to be informed of the existence of processing of personal information

      You have the right to be informed whether personal information pertaining to you shall be, is being, or have been processed, including the existence of automated decision-making and profiling.

    6. The right to damages

      Upon presentation of a valid decision, MRACC recognizes your right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information, taking into account any violation of your rights and freedoms as a data subject.

    7. The right to data portability

      Data portability allows you to obtain and electronically move, copy or transfer your data in a secure manner, for further use, as long as the format for storage of data is uniform across similar platforms.

    8. The right to lodge a complaint before the National Privacy Commission and the Courts

      Should you wish to lodge a complaint for any grievance you may have with regard to your data privacy rights, you may do so before the National Privacy Commission and before the courts of the Philippines.

  10. Amendments to this Notice

    MRACC This Notice may be updated from time to time. You will be notified whenever there are any updates that will significantly affect your rights. Updated versions of this Notice may be accessed through www.mracc.com.ph.

  11. Concerns and Questions

    In case of complaints, concerns, or questions regarding the processing of your Personal Data, or if you wish to exercise your data subject rights, you may address them to:

    MR Angel Credit Corp.

    1808 The Trade and Financial Tower

    32nd St. corner 7th Avenue

    Bonifacio Global City, Taguig City

    dpo@mracc.com.ph