Privacy Statement

CEBUANA LHUILLIER FINANCE CORPORATION (CLFC) PRIVACY STATEMENT AND TERMS OF USE

Last updated: July 30, 2025

Cebuana Lhuillier Finance Corporation (CLFC) is committed to upholding the highest standards of data privacy and protecting the rights and personal information of all individuals. We ensure that all personal data collected from our users, clients, and/or customers is handled and processed in strict compliance with the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and the relevant issuances of the National Privacy Commission (NPC).

PURPOSES OF COLLECTING PERSONAL DATA
CLFC collects personal data from clients, customers, and users with their informed and voluntary consent. This typically occurs when individuals manually or electronically submit inquiries, make requests, or engage in transactions with CLFC.

Prior to any data collection, we ensure that individuals are clearly informed of the purpose, scope, and intended use of their personal information, in full compliance with the Data Privacy Act of 2012, its Implementing Rules and Regulations, and other applicable privacy laws.

We collect personal data to provide secure, lawful, and efficient services, including but not limited to:
1. Financing services
2. Microloans
3. Strategic/business partners with whom we have a relationship with for specific products and services
4. Customer surveys – From time to time, CLFC may conduct surveys to improve our services. Participation is entirely voluntary, and individuals may choose whether to disclose their information. The data collected may include contact details (e.g., email address) and demographic information (e.g., age group, interests). Survey responses are used solely for service enhancement and may be shared only with contractors who assist in administering the surveys.

CLFC may collect, use, disclose, and/or process personal data for the following purposes:
• To evaluate and process your applications and transactions;
• To manage and facilitate your use of our website, mobile app, or digital platforms, including your relationship or account with us;
• To enforce our Terms of Service or any applicable agreements;
• To protect the rights, safety, and property of individuals, CLFC, and the general public;
• To perform identity verification, customer due diligence, and Know Your Customer (KYC) processes;
• To communicate with you via phone, SMS, email, postal mail, or other channels regarding your transactions, inquiries, or service-related updates;
• To conduct research and analysis, including surveys, data analytics, and profiling to enhance our products, services, and customer experience;
• To carry out audits and collect feedback for market and performance evaluation;
• To comply with legal obligations, regulatory requirements, and directives from relevant government authorities;
• To generate reports and statistics for internal or regulatory use;
• To detect, investigate, and prevent fraud, violations of our policies, or other unlawful or suspicious activities;
• To store and back up data for business continuity and disaster recovery;
• To comply with anti-money laundering, counter-terrorism financing, and tax compliance regulations;
• To conduct credit checks and scoring to assess or verify your credit/financial worthiness and to assist other financial institutions to conduct credit checks;
• To perform credit evaluations and scoring to determine or confirm your financial reliability and support other financial institutions in conducting similar assessments.

For other purposes which we may communicate to you at the time of data collection, subject to your consent where required by the DPA, its IRR and any other lawful guidelines and regulations.

WHAT PERSONAL DATA WILL CLFC COLLECT?
To process your transaction, CLFC collects the following information from its customers:
• Complete name;
• Email address;
• Date of birth;
• Present and or permanent address;
• Bank account and payment information;
• Telephone or mobile number;
• Gender;
• Employment details;
• Source of income;
• Proof of income;
• Information sent by or associated with the device(s) used to access our Services
• Information about your network and the people and accounts you interact with;
• Photographs or audio or video recordings that you share with us, including any customer self-portrait (selfie) and scan;
• Government-issued identification or other information required for our due diligence, know your customer, identity verification, or fraud prevention purposes;
• Marketing and communications data, such as your preferences in receiving marketing from us and third parties, your communication preferences and history of communications with us, our service providers, and other third parties;
• Usage and transaction data, including details about your searches, orders, the advertising, and content you interact with on the Platform, and other products and services related to you;
• Location data

WHEN DOES CLFC COLLECT PERSONAL DATA?
CLFC collects personal data at various points throughout your interaction with us, whether in person or online. This includes, but is not limited to, the initial submission of personal information for activities such as account creation, transaction processing, or compliance with Know Your Customer (KYC) requirements.

We may also collect additional or updated personal data during repeat transactions, system upgrades, or in response to changes in regulatory or security requirements. In such cases, clients will be duly informed, and data collection will only proceed with their voluntary and informed consent, in full compliance with the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR), and related issuances of the National Privacy Commission (NPC).

Common instances when personal data may be collected include:
• When you register for and/or use our website or mobile application;
• When we conduct KYC or customer due diligence procedures;
• When you submit forms or documents related to our products and services, whether physically or electronically;
• When you enter into agreements with us or provide supporting documents for your transactions;
• When you communicate or interact with us via phone (calls may be recorded), email, social media, in-person visits, or other channels;
• When you use our digital services, where data may also be collected through technologies such as cookies;
• When you grant device permissions to our platform;
• When you provide feedback, complaints, or inquiries;
• When you voluntarily provide personal data for any other legitimate reason.

**This list is not exhaustive but represents the most common scenarios in which CLFC collects personal data.

We may also collect additional information, such as your address, source of funds, and biometric data (e.g., signature, photo, thumbmark), to enhance fraud prevention and meet regulatory obligations.

All personal data we collect is necessary, relevant, and limited to what is required for the specific purposes stated. CLFC upholds the principle of proportionality, ensuring that no more data is collected than what is legitimately needed.

STORAGE AND TRANSMISSION OF PERSONAL INFORMATION
CLFC implements robust security measures to ensure that all personal data is stored and transmitted safely and responsibly.

We store personal data in encrypted databases hosted on secure servers with strict access controls, accessible only to authorized personnel. Industry-standard encryption protocols, such as AES-256, are used to safeguard data at rest, and regular system backups are performed to ensure data availability and integrity.

During data transmission—such as during online registrations, transactions, or file transfers—your information is protected using secure communication protocols, including HTTPS and SSL/TLS, and transferred through secure file transfer methods such as SFTP.

To further enhance security, CLFC employs:
• Firewalls and intrusion detection systems
• Regular security audits and vulnerability assessments
• Ongoing staff training on data privacy and information security best practices

These measures are designed to maintain the confidentiality, integrity, and availability of your personal data, both in storage and during transmission.

USE AND LIFECYCLE OF PERSONAL DATA
Personal information collected by CLFC is used solely for legitimate and clearly defined purposes, such as identity verification, transaction processing, and compliance with legal and regulatory requirements. Your data will not be used for any unrelated or unauthorized activities without your explicit consent.

In some cases, your information may undergo additional processing, including:
• Data validation and formatting
• Fraud detection and prevention checks
• Use for marketing initiatives and cross-selling of products and services offered by CLFC and its affiliates, with your prior consent

Throughout its lifecycle, your personal data is:
• Securely collected and processed
• Stored and retained only as necessary to fulfill its intended purpose
• Properly disposed of or anonymized when no longer required

All processing activities are carried out in full compliance with the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR), and relevant issuances of the National Privacy Commission (NPC).

LOCATION OF PERSONAL DATA
CLFC stores personal data in secure data centers, which may be physical or cloud-based, and processes it through internal systems or trusted third-party service providers.

To ensure data availability and business continuity, encrypted backups are maintained and securely distributed across multiple locations. All data transmissions are protected through encrypted connections to prevent unauthorized access during transfer.

These practices are aligned with applicable data protection laws and regulations, ensuring that personal information is stored, processed, and transferred securely and responsibly, whether within the Philippines or across international borders.

DATA SHARING
CLFC may share your personal data with authorized personnel, affiliates, and trusted third-party service providers—such as payment processors, collection agents, and system providers—for the purpose of delivering services, fulfilling contractual obligations, and ensuring regulatory compliance.

We may also disclose personal information, when necessary, to:
• Regulatory authorities, national and local credit bureaus, credit reporting and reference agencies, rating organizations (such as the Credit Information Corporation), as well as insurers and insurance intermediaries;
• Law enforcement agencies;
• Business partners, CLFC’s affiliates, agents, service providers and other third parties who:
     • are involved in delivering our products or services, or provide support in our                    operations and functions related to our products or services;
     • may act as CLFC’s consultants or advisers;
• Any individual or entity involved in upholding or asserting our rights under the agreements you have entered into with us, or to protect our customers;
• Other entities as required by law or pursuant to legal obligations; and/or
• Other entities to whom you have granted permission to access or share your information.

All data sharing activities are conducted in a secure manner and in full compliance with the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR), and the relevant issuances of the National Privacy Commission (NPC). We take appropriate safeguards to ensure that your personal data remains protected, confidential, and used only for legitimate and authorized purposes.

RIGHTS TO YOUR PERSONAL DATA
• The right to be informed: ensures individuals are fully aware of how their personal information will be collected, used, stored, shared, and deleted.
• The right to object: ensures that individuals have the right over how their personal information is used, even if the processing is otherwise lawful.
• The right to access: As a data subject, you have the right to request access to the personal information we hold about you. Upon a written and verified request, we will provide you with a summary of the personal data collected, processed, and store.
• The right to correct: it allows individuals to request the rectification of inaccurate or incomplete personal data held by an organization to ensure its accuracy and reliability.
• The right to erase or deletion: allows individuals to request the removal of their personal data from an organization’s records when it is no longer necessary, unlawfully processed, or the individual withdraws consent.
• The right to damages: entitles individuals to seek compensation if they suffer harm or loss due to the unlawful or negligent processing of their personal data by an organization.
• The right to data portability: to obtain and transfer their personal data in a structured, commonly used, and machine-readable format from one organization to another, where technically feasible.
• The right to file a complaint: it allows individuals to lodge a complaint with the National Privacy Commission if they believe their personal data rights have been violated or their data has been unlawfully processed.
Your rights to your personal data are provided in Chapter IV, Section 16 of the Data Privacy Act through the NPC website: https://privacy.gov.ph/data-privacy-act/#w16

SECURITY MEASURES
• Organizational measures: includes mandatory data privacy training programs for employees, the development of privacy policies and manuals, conducting gap assessments, privacy impact assessments of data processing systems, privacy audits, and appointing a Data Protection Officer to ensure compliance with the Data Privacy Act of 2012, its Implementing Rules and Regulations, and other applicable laws.
• Physical measures: include controlled access points, CCTV surveillance, the presence of security personnel to monitor and manage access, as well as securing computers, laptops, servers, storage devices, and their respective locations.
• Technical measures: should encompass regular data backups, encryption, secure file transfers, robust authentication protocols, frequent software and application updates, restricted access controls, VPN, and implementation of firewalls and antivirus software.

RETENTION AND DELETION
The retention period for personal data will be ten (10) years for transactions, or as required to fulfill legal obligations. The destruction of personal data will involve secure deletion methods, including degaussing, overwriting, and physical destruction of hard drives and storage media for digital files, and cross-shredding for printed documents.

COOKIE POLICY STATEMENT
Cebuana Lhuillier Finance Corporation ("CLFC", "we", "our", or "us") values your privacy and is committed to protecting your personal data. This Cookie Policy explains how we use cookies and similar technologies on our website, what information they collect, why we use them, and how you can manage your preferences.
By continuing to browse or use our website, you consent to the use of cookies as described in this policy, unless you choose to disable them through your browser or our cookie management tools.

COOKIE POLICY

I. What Are Cookies
Cookies are small text files stored on your device by websites you visit. These cookies are necessary for the website to function properly and to provide core features such as secure access, session management, and navigation. In addition, we use analytics cookies to collect information about how visitors interact with our website. This data helps us improve overall site performance, content relevance, and user experience.
The types of information collected may include:
• Your IP address
• Browser type and version
• Web pages and time spent on each page
• Approximate geographic location
• Ad impressions and clicks
• Language preferences
• Operating systems and device types
• Web browser type

All data collected through these cookies is aggregated and anonymized and used solely for service improvement and analytical purposes.

II. How We Use Cookies
We use cookies to improve your browsing experience, enhance site functionality, analyze website traffic, and support marketing efforts. These small text files help us remember your preferences, understand how you interact with our content, and deliver relevant information and services. By continuing to browse our site, you consent to our use of cookies in accordance with our Privacy and Cookie Policies.

III. Manage or Disable Cookies

You can manage your cookie preferences at any time. Most web browsers allow you to control or disable cookies through your browser settings. Please note that disabling or blocking certain cookies may impact your experience and limit access to some features of our website.

IV. Third Party Cookies
Our website may allow third-party service providers to place cookies on your device to support features such as analytics, advertising, social media integration, or these cookies are controlled by the third parties and are subject to their own privacy and cookie policies. We do not have direct control over how these third-party cookies operate, but we take steps to ensure that any partners we work with handle your data responsibly and in compliance with applicable data protection laws.

TERMS OF USE
This website is intended to provide general information about our company, services, and offerings. By accessing and using this website, you agree to comply with and be bound by the terms and conditions outlined herein. These Terms of Use govern your access to and use of the website, including any content, functionality, and services offered.

Please read these Terms of Use carefully. If you do not agree with any part of these terms, you must not use this website. CLFC reserves the right to amend or update these terms at any time with effectivity date of 60 days upon publication of the notice.

I. Acceptance of Terms of Use
This website is operated by Cebuana Lhuillier Finance Corporation (CLFC). By using this site, you acknowledge that you have read, understood, and agreed to comply with these Terms of Use, as well as our Privacy Policy.

II. Website Content
All content on this site, including text, graphics, logos, images, and other materials, is the property of CLFC or its licensors and is protected by applicable intellectual property laws. You may use the content for personal, non-commercial purposes only. Unauthorized use or reproduction is strictly prohibited.

III. User Conduct
You agree to use the website only for lawful purposes. You must not:
• Engage in any activity that could harm or disrupt the website or its users;
• Attempt to gain unauthorized access to any part of the site;
• Post or transmit any material that is defamatory, offensive, or violates the rights of others.

IV. Intellectual Property
All content, materials, and features available on this website—including, but not limited to, text, graphics, logos, icons, images, audio clips, video, software, and design elements—are the exclusive property of Cebuana Lhuillier Finance Corporation (CLFC) or its licensors and are protected by applicable intellectual property laws, including copyright, trademark, and other proprietary rights.
You may view and use the content for personal, non-commercial purposes only. Any unauthorized reproduction, distribution, modification, display, or commercial use of any content from this website without prior written permission from CLFC is strictly prohibited.

All trademarks, trade names, and service marks displayed on this website are the property of CLFC or their respective owners. Nothing on this site should be construed as granting any license or right to use any trademark without the prior written consent of CLFC or the third-party owner.

V. Force Majeure
CLFC shall not be held liable for any failure or delay in the performance of our obligations under these terms due to events beyond our reasonable control. These events may include, but are not limited to, acts of God, natural disasters, war, terrorism, government actions, labor disputes, power outages, internet service interruptions, or other unforeseen circumstances that prevent the normal operation of the website. In such cases, we will make reasonable efforts to resume service as soon as possible.

VI. Third-Party Links
This website may contain links to external websites operated by third parties. CLFC does not control these sites and is not responsible for their content, privacy practices, or any damage or loss that may arise from your use of them.

VII. Disclaimer of Warranties
The information and materials on this website are provided on an “as is” and “as available” basis. Cebuana Lhuillier Finance Corporation (CLFC) makes no representations or warranties of any kind, whether express or implied, regarding the accuracy, completeness, reliability, suitability, or availability of the website or the information, products, services, or related graphics contained herein.

To the fullest extent permitted by law, CLFC disclaims all warranties, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation. CLFC does not warrant that this website, its servers, or any email or content sent from the site are free of viruses, malware, or other harmful components.

Your use of the website and any reliance on the materials contained herein is at your own risk.

VIII. Limitation of Liability
To the fullest extent permitted by applicable law, Cebuana Lhuillier Finance Corporation (CLFC) , its affiliates, directors, officers, employees, agents, and service providers shall not be liable for any direct, indirect, incidental, consequential, special, or exemplary damages arising out of or in connection with your access to or use of this website, including but not limited to damages for loss of profits, data, goodwill, or other intangible losses.

This limitation of liability applies regardless of the legal basis of the claim—whether arising from warranty, contract, tort (including negligence), or any other legal theory—even if, CLFC has been advised of the possibility of such damages. Your sole and exclusive remedy for any dissatisfaction with the website or its content is to stop using the site.

IX. Customer Service & Support
To effectively respond to general inquiries or concerns regarding CLFC’s products and services, we provide customer support through various channels, including Messenger, email, SMS, and feedback forms.

In the course of providing support, we may collect your contact information, specifically your mobile number and email address. This information is used solely for customer service purposes, such as addressing your concerns or responding to your inquiries.

Feedback, queries and transaction concerns on our products and services: [email protected]

IX. Modifications
CLFC reserves the right to modify, update, or revise any part of this website, including these Terms of Use, at its sole discretion. Any such changes will be posted on this page and will take effect 60 days after the date of publication, unless otherwise stated.

We encourage users to review the Terms of Use periodically to stay informed of any updates. Continued use of the website after the 60-day notice period shall constitute acceptance of the revised terms.

X. Governing Law
These Terms of Use, including any disputes arising from or related to your use of this website, shall be governed by and construed in accordance with the laws of the Republic of the Philippines. By accessing and using this website, you agree to submit to the exclusive jurisdiction of the proper courts of Makati City, Philippines, waiving any objections to such venue.

XI. Entire Agreement and Severability
These Terms of Use, together with our Privacy Policy and any other legal notices published on this website, constitute the entire agreement between you and Cebuana Lhuillier Finance Corporation (CLFC) regarding your use of the website.

They supersede any prior agreements, understandings, or representations, whether written or oral, related to such use.

If any provision of these Terms is found to be invalid, illegal, or unenforceable under applicable law, that provision shall be enforced to the maximum extent permissible, and the remaining provisions shall remain in full force and effect.

XII. Data Protection Office Contact Information
For Data Privacy-related queries and concerns, you may contact the Data Protection Office through: [email protected]