Kasalo Friday

Privacy Notice

This privacy notice is intended to provide you with the information required under the Philippines’ Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, its corresponding implementing rules and procedures (“IRR”), and other issuances of the National Privacy Commission (“NPC”) (hereinafter, collectively referred to as the “DPA”), regarding how ORIENTE EXPRESS TECHSYSTEM CORPORATION (“Cashalo”) processes your personal data and/or sensitive personal data you submit through this survey form (hereinafter, collectively referred to as “Personal Data”).

1. The Personal Information Controller (PIC) and the recipients of Personal Data

Cashalo is an independent PIC of your Personal Data submitted via this portal. Cashalo’s registered address is at 19th Floor, Exxa Tower, Bridgetowne, C-5 Road, Barangay Ugong Norte, Quezon City. OETC’s Data Protection Officer can be reached out to using the privacy portal (https://cashalo-privacy.atlassian.net/servicedesk/customer/portals) or dpo@cashalo.com.

2. Personal Data collected

You have control over the Personal Data you wish to submit via this privacy portal. In general, the Personal Data we collect using this survey form includes the following:

• Full name

• Mobile Number

• Address

• Cashalo username

• Screenshot of comment

When you are selected as a winner of the #KasaloFriday Promo, we may require additional information from you such as a copy of your government-issued ID to allow us to verify your identity.

3. Purpose of collection of Personal Data and the applicable legal basis

We are collecting the Personal Data on the basis of our legal obligation to abide by the requirements imposed by the Department of Trade and Industry (DTI):

• Your full name and Cashalo username will be used for the verification of your identity as a customer of Cashalo;

•
Your mobile number will be used to contact you in relation to Cashalo promos;

• Your address will be used for contacting you, in case we are unable to get in touch via your mobile number; and

• The screenshot of your comment to verify your submission for the #KasaloFriday Promo.

All the Personal Data will be provided to DTI as may be required by the regulator.

4. Period of storage of your Personal Data

Subject to exception under the DPA, your Personal Data will be stored for ten (10) years on the basis of our legitimate interest to evidence our compliance with our legal obligation. Once retention period has expired, your Personal Data will be deleted or anonymized securely according to industry accepted standards.

5. Your data subject rights
You have the following data subject rights under the DPA: right to access

• Right to be informed (Section 16(a) & 16(b), DPA)

• Right of access (Section 16(c), DPA)

• Right to rectification (Section 16(d), DPA)

• Right to erasure or blocking (Section 16(e), DPA)

• Right to damages (Section 16(f), DPA)

• Right to data portability (Section 18, DPA)

• Right to object (Section 34(b), IRR).