Data Privacy Statement

BANK ONE SAVINGS CORPORATION ("Bank One," "we," "us," or "our") respects your privacy and is committed to protecting the privacy and confidentiality of your personal information. We collect, use, process, store, and disclose personal information only for legitimate and lawful purposes and in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, applicable issuances of the National Privacy Commission (NPC), and other applicable banking laws and regulations.

1. Personal Information We Collect

Depending on the products and services you avail of, we may collect personal information such as:

• Full name, date and place of birth, address, contact details, and identification information;
• Government-issued identification documents and related information;
• Employment, business, financial, and credit information;
• Account, deposit, loan, and transaction information;
• Signatures and other information required to establish and maintain your banking relationship;
• Information provided when you communicate with or visit our branches and offices; and
• CCTV images and other security-related information collected within our premises.

We collect only information that is reasonably necessary for the provision of banking services, security, compliance, and legitimate business purposes, consistent with the principles of transparency, legitimate purpose, and proportionality under Republic Act No. 10173.

2. How We Collect Your Personal Information

As a traditional banking institution, we primarily collect personal information through:

• Account opening and application forms;
• Documents and information submitted at our branches and offices;
• Face-to-face transactions and communications with our personnel;
• Telephone or other non-digital communications;
• Banking and transaction records;
• Information provided by authorized representatives or other persons acting on your behalf; and
• Other lawful sources, where permitted by applicable law.

BANK ONE SAVINGS CORPORATION does not currently provide digital banking or e-banking services and does not use artificial intelligence (AI) to make decisions concerning your banking relationship.

3. Purposes of Processing

We may process your personal information for purposes including:

• Opening, maintaining, and administering your accounts and banking relationships;
• Processing deposits, withdrawals, payments, loans, and other banking transactions;
• Verifying your identity and preventing fraud, money laundering, and other unlawful activities;
• Assessing and managing credit and other financial risks;
• Communicating with you regarding your accounts, transactions, and banking services;
• Maintaining the security of our branches, offices, personnel, customers, and assets;
• Complying with legal, regulatory, tax, accounting, and reporting obligations;
• Responding to lawful requests from government authorities, courts, regulators, and law enforcement agencies; and
• Protecting our legal rights and legitimate business interests.

These activities are conducted in accordance with the lawful processing requirements and principles established under Republic Act No. 10173.

4. Sharing and Disclosure of Personal Information

We do not sell your personal information.

Where necessary and permitted by law, your personal information may be disclosed to authorized employees, service providers, professional advisers, auditors, regulators, government agencies, law enforcement authorities, and other parties where disclosure is required or authorized by applicable law or court order.

5. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to maintain appropriate banking and business records, and to comply with applicable legal, regulatory, accounting, and reporting requirements.

When personal information is no longer required, we will dispose of or securely delete it in accordance with our records retention and disposal policies of 5 years.

6. Security Measures

We implement reasonable organizational, physical, and technical measures to protect personal information against unauthorized access, disclosure, alteration, loss, destruction, or other unlawful processing, consistent with the requirements of Republic Act No. 10173.

These measures include appropriate controls over access to customer records, secure storage of physical documents, employee confidentiality obligations, branch security measures, and procedures for handling and disposing of personal information.

7. Your Privacy Rights

Subject to applicable laws and regulations, you may have rights concerning your personal information under Republic Act No. 10173, including the right to:

• Be informed about how your personal information is processed;
• Access personal information held about you;
• Request correction of inaccurate or incomplete information;
• Object to or request restriction of certain processing;
• Request deletion or removal of personal information where legally permitted;
• Exercise the right to data portability, where applicable; and
• Lodge a complaint concerning the processing of your personal information.

Certain requests may be subject to legal, regulatory, contractual, or legitimate business requirements. We may also need to verify your identity before responding to a request.

8. Website and Digital Services

Bank One currently does not provide online banking or e-banking functionality through this website.

The Bank's website is primarily intended to provide information about Bank One Savings Corporation, its products and services, branches, and other relevant information.

Bank One does not use cookies or similar tracking technologies on this website and does not maintain website session or access logs for the purpose of tracking individual website visitors.

Where you voluntarily submit personal information through a website feature, inquiry, contact facility, electronic communication, or other online functionality, Bank One will process such information in accordance with this Data Privacy Statement, Republic Act No. 10173, and other applicable laws and regulations.

Where third-party services or embedded content are made available through the Bank's website, such third parties may process information in accordance with their own privacy policies and applicable terms. Bank One does not control the privacy practices of third-party websites or services.

Bank One will update this Data Privacy Statement when material changes are made to its website or digital services that affect the processing of personal information.

9. Automated Decision-making and Profiling

Bank One does not currently use artificial intelligence or automated decision-making systems through its website to make decisions that produce legal effects or similarly significant effects on individuals.

Where automated decision-making or profiling is introduced in a manner covered by applicable data privacy requirements, Bank One will provide the information required by law, including information regarding the relevant processing, its significance, and the envisaged consequences for the data subject, where applicable.

10. Third-party Websites and Links

The Bank's website may contain links or references to third-party websites or services for information or convenience.

Bank One is not responsible for the privacy practices, content, or security of third-party websites that are not operated or controlled by Bank One.

We encourage users to review the privacy notices of third-party websites before providing personal information to them.

11. Changes To This Data Privacy Statement

Bank One may update or revise this Data Privacy Statement from time to time to reflect changes in our operations, services, applicable laws and regulations, regulatory requirements, or data processing practices.

When material changes are made, Bank One will provide appropriate notice to data subjects in accordance with applicable requirements.

12. NPC Seal of Registration

Bank One Savings Corporation's NPC Seal of Registration is displayed on this website and in conspicuous areas of our offices and branches where personal data is processed, in accordance with applicable National Privacy Commission requirements.

The NPC Seal of Registration and Certificate of Registration are issued through the National Privacy Commission Registration System (NPCRS).

The registration of Bank One does not relieve the Bank of its continuing responsibilities under the Data Privacy Act of 2012 and other applicable laws and regulations.

13. Contact Us

If you have questions, concerns, or requests regarding the processing of your personal information, you may contact our Data Protection Officer/Privacy Officer:

We will review and respond to privacy-related requests in accordance with Republic Act No. 10173, applicable regulations, and our internal procedures. You may also contact the National Privacy Commission (NPC) regarding concerns or complaints relating to your rights under the Data Privacy Act of 2012.

This Data Privacy Statement has been updated as of September 2026.