Data Privacy Notice

RCBC DATA PRIVACY NOTICE

Who is providing this notice?

As the personal information controller under Republic Act No. 10173, or the “Data Privacy Act” of 2012, RCBC gives this notice to inform you of your rights and our obligations under the law. 

DATA COLLECTION
What personal information do we collect?

We collect different types of personal data depending on the product or service that you avail or intend to avail from us, including but not limited to:

• Full name, gender, place and date of birth;
• Residential/permanent address and/or present address;
• Copy of IDs such as PhilID (National ID) or ePhilID (including printed ePhilID) passport, TIN, SSS/GSIS number, or other Government-issued IDs;
• Employment or business information;
• Payment details, including credit card and banking information;
• Contact details, including telephone number and email address;
•  Most recent documents to prove Source of Wealth or Source of Income;
• Latest billing  to verify permanent address and/or present address;
• Images  , including videos and photographs, collected  through CCTV, and similar devices when you visit our premises, ATMs, or when  using our virtual KYC tools (which may be outsourced);
• Voice recordings of telephone-initiated transactions and customer service calls; and
• Other information necessary to provide you with the product or service that you need.

Additional personal data that we collect over the course of our relationship with you

Throughout the duration of our relationship, we may collect data about you, including, but not limited to your transactions, account history and behavior, information, and inquiries about our products and services.

How do we collect your personal data?

We obtain information from you through various means.  This may occur when you fill out a form with us, when you give us a call, use our websites or mobile applications, or  visit one of our business centers. We may also collect your information  through the following means:

• In applications, emails and letters to us, in customer surveys, during financial  assessment and interviews.
• From data analysis related to your payments and other transactions, including aspects such as the amount, frequency, geographical location, source, and recipient,  as well as your use of our products and services.
• Information that we receive from our subsidiaries and affiliates,  as well as from or through other organizations  such as, card associations, credit bureaus, insurance companies, and fraud prevention agencies, whether during the provision of products and services to you or otherwise.

How do we collect and manage your sensitive personal information?

The Data Privacy Act  categorizes the following information as sensitive:

• Race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
• Health, education, genetic or sexual life of a person;
• Proceeding for any offense committed or alleged to have been committed by such person, or the sentence of any court in such proceedings; and
• TIN, SSS/GSIS number, health records, licenses, tax returns, etc.

With your consent, we will collect your sensitive information for legitimate purposes, and in cases permitted or required by law.

Personal data that we collect as authorized or required by law

We may also collect information about you when required or authorized by law. For example, we require your personal data to  confirm your identity under Republic Act No. 9160 or the Anti-Money Laundering Act of 2001.

Personal data that we collect via your web activities

RCBC uses "Google Analytics" to collect information about use of this site. Google Analytics collects information such as how often users visit this site, what pages they visit when they do so, and what other sites they used prior to coming to this site. We then use the information collected from Google Analytics only for purposes of improving this site. Google Analytics collects only the IP address assigned to you on the date you visit this site, rather than your name or other identifying information. RCBC does not combine information collected through the use of Google Analytics with any of your personally identifiable information.

RCBC, including its subsidiaries, may partner with third party service providers, such as Microsoft Clarity and Microsoft Advertising, to analyze website usage and interactions through tools like behavioral metrics, heatmaps, and session replay. This information helps improve products, services, and online experiences, as well as support site optimization, fraud prevention, security, and advertising purposes. For details on how these third parties collect and use your data, please refer to their respective privacy statements. You may also consult the specific privacy statements of each of the Bank's subsidiaries for further information on their data privacy practices.

Please note that some information may be gathered with the use of 'cookies' which are small pieces of information stored on your browser that may be retrieved by the site. Although Google Analytics plants a permanent cookie on your web browser to identify you as a unique user the next time you visit this site, the cookie cannot be used by anyone but Google and will allow Google Analytics to recognize you  upon your return to the site. Should you wish to disable these cookies, you may do so by changing the appropriate settings on your web browser.

Personal data that we collect through social media

We  understand that some of you  prefer to engage with us through social media. So that we can respond to your inquiries, we may ask for your name, contact number and email address. We will only collect your information with your consent. For account and transaction inquiries,  please feel free to reach out to our Customer Contact Center.

When will we notify you that we have received your information?

 Upon receiving your personal information, we will take reasonable steps to notify you on how and why we collected your information, who we may disclose it to, and the procedures on how you can access ,  correct or file a complaint about your data. This notice may already be included in the form or document that you filled out and submitted to us. In instances  where we receive your personal data from third parties, we presume that you have permitted these parties to share your data with us. We will notify you of the circumstances of such collection upon your request.

DATA USE

Why do we use your personal data?

We use your personal data for  several purposes, mainly:

• To comply with law and regulation ( such as KYC or client identification);
• To carry out our obligations arising from contracts entered between you and  our organization;
• To conduct our everyday business   operations( including processing your transactions and maintaining your account).

Collecting your personal data  enables us to provide you with the products and services you requested. This means we can also use your information to:

•  Assess your eligibility for the requested  products and services, ;
• Process your application; and
• Conduct market  and business research, which may include customer profiling.

Will we use your personal data for customer profiling and direct marketing?

With your consent, we may use your personal data to let you know about non-bank products and services that we believe may be of interest to you, including products and services from our related companies (cross-selling). To help us  in identifying offers most suitable to you, we may use automated tools for profiling and data analytics.

Such marketing activities may be  through mail, telephone, SMS, email, or any other electronic means. We may also market our products through third party channels ,such as social media sites, and collaborate with partners.

You  may inform us at any time if you no longer wish to receive direct marketing offers or object to the processing of your data for profiling purposes.

DATA RETENTION

How long do we keep your personal data?

Your personal information shall be retained for the duration necessary to fulfill the purposes for which it was collected, and such other purposes that you may have consented to from time to time.

We also  retain your information for  the duration required by applicable laws and regulations.

How do we take care of your personal data?

We store information in both paper and electronic formats. The security of your personal data is important to us and we take reasonable steps to protect it from misuse, interference, loss, unauthorized access, modification, and unauthorized disclosure by establishing and enforcing measures that include, but not limited to, the following:

• Confidentiality requirements and data privacy training  for our employees;
• Document storage security policies;
• Security measures to  regulate access to our systems and premises;
• Limitations on access to personal data;
•  Careful selection of third party data processors and partners; and
• Electronic security systems,   including firewalls and data encryption  for our websites and mobile applications.

We may store your personal data physically or electronically with third party data storage providers. When we do this, we use contractual arrangements to ensure those providers take appropriate measures to protect that information and  limit the  purposes in which they can  utilize it.

DATA SHARING

Sharing with the government

To comply with legal and regulatory mandates, we submit required information to government agencies, like the Bangko Sentral ng Pilipinas (BSP), Bureau of Internal Revenue (BIR), and Securities and Exchange Commission (SEC).

Sharing with Credit Reporting Bodies

Pursuant to Republic Act No. 9510 or the Credit Information System Act, we may disclose your personal and other relevant information  with the Credit Information Corporation in connection with your application for and availment of a credit facility with  our organization. This information may include data on your creditworthiness. Additionally, we may also share such information with other credit bureaus authorized by the Credit Information Corporation.

Sharing with Service Providers

In the normal course of our banking operations, we may share your data with third party service providers who passed our due diligence assessment to perform tasks and activities on our behalf. They will be provided only with personal data necessary to perform their services. Contractual protections and monitoring procedures are in place to ensure they do not process such data for other purposes. These activities may be performed by IT firms to provide us with application systems and IT infrastructure services, including cloud services.

Sharing with other persons and entities

After obtaining your consent, we may disclose your information to third parties for further processing such as marketing, cross-selling and other specified legitimate purposes. In instances where your information is shared with third parties, we will ensure that we would only share your data with entities that can demonstrate sufficient organizational, technical and physical security measures.

DATA DISPOSAL

What happens when we no longer need your information?

We will only retain your information for the duration necessary  to fulfill the purpose for which they were collected, or as required by applicable laws and regulations. We will destroy your personal data when its retention is no longer  necessary by purpose, law or regulation.

ACCESS AND CORRECTION

How do you access or correct your personal data?

Unless there are practical, contractual and legal reasons why we cannot process your request, you have the right to ask for a copy of any personal information we hold about you, as well as to request corrections if you believe the information is inaccurate. To do so, please send an email to dataprivacy@rcbc.com.

YOUR RIGHTS AS A DATA SUBJECT

Under the Data Privacy Act, you have the right:

• To be informed– as a data subject, you have the right to be informed that your personal data will be, are being, or were, collected and processed.
• To access– you have a right to obtain a copy of any information relating to you that we have on our computer databases and/or manual filing systems. It should be provided in an easy-to-access format, accompanied with a full explanation executed in plain language.
• To object– unless required by law, rules and other regulations, you have a right to object to the processing of your personal data, including processing for direct marketing, automated processing or profiling.
• To erasure or blocking– you have the right to suspend, withdraw or order the blocking, removal or destruction of your personal data.
• To be indemnified of damages– you may claim compensation if you suffered damages due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data, considering any violation of your rights and freedoms as data subject.
• To data portability– you have the right to obtain and electronically move, copy or transfer your data in a secure manner, for further use.
• To rectify– you have the right to dispute and have corrected any inaccuracy or error in the data we hold about you.
• To file a complaint– If you feel that your personal information has been misused, maliciously disclosed, or improperly disposed of, or that any of your data privacy rights have been violated, you may file a complaint or any concern with our Data Protection Officer and/or with the National Privacy Commission.

CHANGES TO OUR PRIVACY NOTICE

We may amend this Notice to comply with changes in relevant laws and regulations, and to keep you informed of changes in the ways we process your personal data.

Updates will be posted on this website.

CONTACT US

We care about what you think and we welcome your feedback. You can contact us:

• thru our Customer Contact Center: +632 8877 RCBC (8877 7222);
• by speaking to any business center personnel;
• For RCBC Trust, you may call our Trust and Investments Group: 8894-9506 (Trust Marketing), 8894-9000 loc. 3319 (Investment Services Division) and 8894-9000 loc. 3325 (Trust Operations)
• For your RCBC Diskartech concerns and requests, you  may send an email to help@diskartech.ph.

Data privacy requests and concerns

For your data privacy concerns and requests, you may contact our Data Protection Officer
Email: dataprivacy@rcbc.com
Address: Regulatory Affairs Group Office, RCBC Plaza, 6819 Ayala Avenue, Makati City, Philippines

For data privacy concerns and requests related to your RCBC Credit Cards, you may contact dataprivacy@rcbcbankard.com.

You may also contact the National Privacy Commission
Email: info@privacy.gov.ph or complaints@privacy.gov.ph
Address: 5th Floor Delegation Building, PICC Complex, Roxas Boulevard
Mobile Nos. 09451534299 / 09399638715