POLICY STATEMENT

This General Data Privacy Policy (“Privacy Policy”) demonstrates Monde MY San Corporation’s (“MMYSC’s”) commitment to protect and maintain the security and privacy of personal information provided by, or collected or processed from, MMYSC’s employees, contract counterparties, distributors/sub-distributors, suppliers, service providers, applicants applying for employment with MMYSC, or any other individuals who interact with MMYSC in the regular course of business (each, a “Data Subject” and collectively, the “Data Subjects”).

As an organization that values compliance with law at all times, MMYSC recognizes the paramount importance of data privacy and security, and adheres to the standards of data privacy and protection under Republic Act No. 10173, or the Data Privacy of 2012 and its implementing rules and regulations, and the various issuances of the Philippines National Privacy Commission and other relevant regulatory agencies (“Data Privacy Laws”).

This Privacy Policy will help you understand: (i) what personal information MMYSC collects; (ii) how MMYSC collects, holds, uses and discloses personal information collected; and (iii) how you, as a Data Subject, can exercise your rights under the Data Privacy Laws.

COVERAGE OF PRIVACY POLICY

This Privacy Policy applies to MMYSC’s Data Subjects.

This Privacy Policy does not apply to any website, product or service of any third-party entity or organization even if the website links to (or from) MMYSC’s website. It is always a good practice and habit to always review the privacy practices and policies of any third party entity or organization when deciding whether to provide any personal information to such entity or organization.

HOW DOES MMYSC COLLECT YOUR INFORMATION?

This section discusses MMYSC’s “Personal Information Collection Methods”, or the general instances when MMYS collects your Personal Information:

1. when you visit MMYSC’S website at https://www.mysan.com.ph/ and you contact MMYSC by sending an inquiry, a comment, complaint or feedback, or when you submit your resume in connection with employment opportunities in MMYSC;
2. when you enter into contracts, or perform transactions, with MMYSC;
3. when you provide your personal information in any medium or form of communication with any duly-authorized employee or representative of MMYSC;
4. when MMYSC obtains verification information about you through trusted third parties (i.e., social media pages MMYSC owns or controls); and
5. passively, through technology such as “cookies”.

WHAT PERSONAL INFORMATION DOES MMYSC COLLECT?

Through the Personal Information Collection Methods, MMYSC may, at the minimum, collect the following Personal Information from you:

1. Name; and
2. Contact details (e.g., telephone or mobile number, email address, mailing address/location, social media username, etc.)

For specific transactions or projects other than the above general instances where your Personal Information is collected or processed by MMYSC, please refer to the Privacy Notices and Consent Forms that MMYSC provides you as a Data Subject customized for said transactions and projects taking into consideration the data privacy principles of legitimate purpose, transparency and proportionality.

For purposes of this Privacy Policy, “Personal Information” refers to any data (whether by itself or when linked with other information) in the possession of, or likely to come into the possession of, MMYSC, which data can be used to identify a specific living person. Personal Information does not include information that has been aggregated or made anonymous such that it can no longer be reasonably associated with a specific person.

WHY DO WE COLLECT YOUR PERSONAL INFORMATION?

MMYSC collects your Personal Information for any of the following purposes:

1. Employment-related –
   • in fulfillment of MMYSC’s obligations as an employer in relation to its employees;
   • to process job applications from applicants.
2. Consumer service –
   • to respond to inquiries, concerns, and complaints, or to provide feedback regarding the products MMYSC distributes.
3. Marketing and promotional activities –
   • maintaining communication with you regarding the products MMYSC distributes, or generally to communicate to you our product campaigns or promotions, with your consent;
4. In order to perform MMYSC’s contractual obligations with its contract counterparties (e.g., its distributors/sub-distributors, service providers, suppliers, or with any other individual or entity with a business relationship with MMYSC);
5. Legal purposes –
   • to assert or prosecute legal claims by, and defend claims against, MMYSC;
   • in case of a potential merger, consolidation, acquisition or capital raising activity involving the Company, we may share your personal information with the counterparty or potential buyers or investors only to the extent the same is critical to said activity; or
   • in compliance with regulatory or legal requirements;
   • in response to subpoena or other regular and valid processes of a court of administrative agency with jurisdiction;
   • to enforce, guarantee or maintain the safety, health and security of MMYSC’s personnel and/or assets.
6. Other purposes ancillary to the above –
   • Assessment or review of MMYSC’s compliance with applicable laws and regulations (including accounting regulations), or with internal processes and procedures, or in relation to MMYSC’s engagement with professional advisors such as legal counsel, audit firms/external auditors, or insurance agents.

BASES FOR PROCESSING OF PERSONAL INFORMATION

MMYSC processes your personal information for any of the purposes declared in this Privacy Policy, based on any of the following:

1. your consent as Data Subject;
2. fulfillment of contractual obligations;
3. fulfillment of statutory or regulatory obligations; and
4. MMYSC’s legitimate interests.

TRANSFER AND DISCLOSURE OF PERSONAL INFORMATION

MMYSC may share, transfer, and disclose your Personal Information to the following:

1. MMYSC’s third party suppliers and service providers, such as the following:
   • Data entry services;
   • Database management services;
   • Payment processing services;
   • Logistics providers;
   • Data disposal services;
   • Legal services;
   • Audit services;
2. MMYSC’s professional advisers (e.g., legal counsels, external auditors/auditing firms), law enforcement agencies, insurers, and regulators, both from the government and private entities, such as stock exchanges or market operators;
3. MMYSC’s subsidiaries and affiliates; and/or
4. Potential joint venture partners, creditors, or investors.

WHAT ARE YOUR RIGHTS AS A DATA SUBJECT?

MMYSC recognizes your rights as a Data Subject, as provided under the Data Privacy Laws:

1. Right to be informed
   Through this Privacy Policy, MMYSC notifies you what Personal Information is collected, the instances when Personal Information is collected, the means of and the purposes for the processing of your Personal Information, your rights as a Data Subject, and how MMYSC protects your Personal Information.
   
   
2. Right to object
   You have the right to object to the processing of your Personal Information, such as when processing is based on your consent or on MMYSC’s legitimate interest. You shall be notified, and be given an opportunity to object and/or withhold consent to the processing of your Personal Information in case of any significant changes or any necessary amendment to the information you supplied or declared to MMYSC, such as in the following instances: (i) change in the identity of the personal information controller; (ii) the purpose/s of processing; (iii) scope and method of processing; and (iv) other analogous instances. you also have the right to object if the processing of your personal information is for direct marketing, automated processing or profiling purposes.
   
   
3. Right to Access
   You have a right to be given reasonable access to specific kinds of information identified in the Data Privacy Laws upon your written demand. However, your right to access is only with respect to your own Personal Information (and other information you provided in accordance with the Data Privacy Laws) and not to information relating to any other individual. Your request to access certain kinds of information may also be denied by MMYSC if: (i) what you seek to access relates to publicly-available information; (ii) in case of unreasonable requests especially of a repetitive and vexatious nature and which does not appear to be made in good faith; (iii) the request will entail MMYSC having to exert effort and expend resources to retrieve or gather such information, in a manner and extent which are manifestly disproportionate to the kind of information requested and/or the purposes for which the information is being sought; and
   
   MMYSC considers, after due consideration, that granting access to the information requested will endanger or compromise the safety or well-being of the Data Subject or any other person. MMYSC may, in certain instances, charge you a reasonable fee for the costs incurred by MMYSC in connection with your request to access your personal information in MMYSC’s system, such as when servicing your request would involve MMYSC incurring unusual costs or harnessing resources.
   
   You may use the Access Request Form attached to this Privacy Policy as Annex A to submit requests to MMYS pursuant to your right to access as described above.
   
   
4. Right to Rectification
   You have the right to dispute any inaccuracy or error in your Personal Information that MMYS may be holding. In such cases, MMYSC will accordingly correct any error(s) promptly, unless your request is found to be malicious or unreasonable.
   
   MMYSC may also, in certain instances prescribed by law, require proper notice of the valid order of or process from a competent court or a government agency before making any changes or modifications to the Personal Information it holds.
   
   You may use the Rectification Request Form attached to this this Privacy Policy as Annex B to submit requests to MMYSC pursuant to your right to rectification as described in the above.
   
   
5. Right to Erasure or Blocking
   You have the right to suspend, withdraw, or order the blocking, removal or destruction of your Personal Information from MMYSC’s data filing system, upon presentation of substantial proof that:
   1. The personal data or private information is:
      • incomplete, outdated, false, or unlawfully obtained;
      • used for an unauthorized purpose;
      • no longer necessary for the purpose/s for which they were collected; or
      • prejudicial to the Data Subject, unless justified by freedoms guaranteed under the Constitution or applicable laws, or otherwise authorized by a court order;
   2. The Data Subject objects to the processing, and there are no other applicable lawful criteria for processing;
   3. The processing is unlawful; or
   4. In case of violation of the rights of the data subject.
   
   
   You may use the Erasure Request Form attached to this Privacy Policy as its Annex C to submit requests to MMYSC in the exercise your right to erasure or blocking.
   
   
6. Right to data portability
   You have the right to receive Personal Information that you have provided MMYSC in a structured, commonly used, and machine-readable format, for further use. You also have the right to request from MMYSC that it transfers or transmits your data to another controller. Data portability allows you to manage your Personal Information on your private device.
   
   
7. Right to Damages
   MMYSC recognizes your right to receive damages which you may have actually incurred as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of Personal Information, following adjudication of such damages in your favor as stated in a final and executory decision of a court or quasi-judicial authority (as the case may be) with jurisdiction and rendered and enforced in accordance with prescribed procedure.
   
   

HOW LONG DOES MMYSC KEEP YOUR PERSONAL INFORMATION?

In accordance with the Data Privacy Laws and other applicable laws, MMYSC will keep your Personal Information for as long as reasonably necessary to:

• fulfill declared, specified, and legitimate purposes, or when the processing of such information relevant to said purposes has not yet been terminated;
• establish, exercise, or assert MMYSC’s legal rights, or to defend claims and actions against MMYSC;
• pursue legitimate business purposes consistent with applicable industry standards, or as approved by regulator(s) or the relevant government agency;
• comply with MMYSC’s statutory, regulatory and other good governance compliance obligations (e.g., fraud identification and protection, anti-money laundering regulations, tax compliance, and regulatory disclosures).

This Privacy Policy’s Annex D sets out the various data retention periods in connection with MMYSC’s data processing activities.

MMYSC will, after the applicable data retention period, dispose of or discard your Personal Information in a manner that is secure and which would prevent further processing, unauthorized access, or disclosure to any other party, or would otherwise cause prejudice to other persons.

HOW DOES MMYS PROTECT YOUR PERSONAL INFORMATION?

MMYSC has put in place physical, electronic, and administrative procedures and safeguards designed to prevent unauthorized access, maintain data security, and for the correct usage of the Personal Information that MMYSC collects through the Personal Information Collection Methods. These safeguards vary, depending on the sensitivity of the Information that MMYSC collects and stores. It must be emphasized that no data transmission or storage system is guaranteed to be 100% secure. If you suspect that a data breach concerning your Personal Information has occurred, please contact MMYSC that it transfers or transmits your data to another controller. Data portability allows you to manage your Personal Information on your private device.