PAYDA PRIVACY POLICY

1. PERSONAL INFORMATION CONTROLLER

The entity responsible for personal information processing conducted by PAYDA is:

PAYDA may engage third-party Personal Information Processors to process personal information on its behalf.

Depending on the actual service, banks, payment providers, Voucher Providers and participating merchants may independently act as Personal Information Controllers for processing activities that they determine and perform under their own legal and regulatory obligations.

2. PRIVACY PRINCIPLES

PAYDA is committed to processing personal information according to the principles of:

• Transparency
• Legitimate purpose
• Proportionality
• Data minimization
• Accuracy
• Security
• Accountability

PAYDA collects and processes only information reasonably necessary for legitimate and lawful purposes.

3. PERSONAL INFORMATION WE COLLECT

The type of personal information collected depends on the PAYDA Service you use.

3.1 Account and Registration Information

PAYDA may collect:

• Full name
• Preferred name or nickname
• Mobile phone number
• Email address
• Date of birth
• Gender, where required
• Residential or mailing address
• Nationality
• PAYDA Account ID
• Internal Member ID
• Profile information
• Account status
• Registration information

4. IDENTITY VERIFICATION AND KYC INFORMATION

Where necessary for registration, funding, purchases, refund verification, fraud prevention or legally applicable due-diligence requirements, PAYDA and relevant verification providers may collect the following, limited to what the specific purpose requires:

• Full legal name
• Date of birth
• Nationality
• Residential address
• Mobile phone number
• Email address
• Government-issued identification information
• Identification document images
• Identification verification results
• Occupation
• Employer information, where required
• Source of funds
• Source of income
• Purpose of transaction
• Beneficial ownership information
• Tax or regulatory information where legally required
• Risk classification
• Customer due-diligence information
• Enhanced due-diligence information

The information required may differ depending on the type of account, transaction, customer risk classification, applicable law and the necessary requirements of the relevant service provider. PAYDA shall explain the purpose and lawful basis for required information, including the applicable condition for sensitive personal information.

5. FUNDING, PURCHASE BALANCE, VOUCHER AND REFUND INFORMATION

5.1 Funding and Purchase Balance

For funding, PAYDA processes the Member or account identifier, requested top-up amount, unique VCA number generated using the assigned Netbank partner alias, exact-amount limit, validity period, payment instructions, payment reference, amount received, time, settlement status, incoming webhook or provider reference, duplicate-check results, fees and reconciliation records. Funds are received in the linked PAYDA/Bentix corporate collection account at Netbank. PAYDA verifies settlement, amount, reference and duplicates before recording Purchase Balance. Payment-source and account-ownership information is limited to what is necessary for verification, disputes and applicable obligations; the VCA does not by itself open a personal bank account for the Member.

For account linking and conversion, PAYDA and YAHOYA process the source and destination account identifiers, linking and authorization records, requested amount, disclosed conversion rate and fees, expected point credit, unique conversion reference, timestamps, verification and available-balance results, PAYDA reservation or debit, confirmation, YAHOYA credit status, and reversal or restoration records. These records authenticate the request, prevent duplicate transactions, reconcile pending or failed conversions and resolve complaints. Credentials or authorization tokens used for the connection shall be protected and limited to the supported purpose; Members should not send passwords, PINs or OTPs in support messages.

For eligible YAHOYA Refund requests involving the return of YAHOYA Points to PAYDA Purchase Balance, Bentix processes the Member's linked account identifiers, requested refund amount, applicable fees, net PAYDA Purchase Balance to be credited, transaction references, processing status and reconciliation records. This information is used to verify the refund request, process the corresponding balance adjustments, prevent duplicate transactions and resolve disputes.

5.2 eGift and Digital Voucher Information

YAHOYA processes eGift selection, merchant, denomination, final selling price, applicable disclosed charges, YAHOYA Points deduction, order reference and status. YAHOYA sends the purchase request and only necessary order or delivery data to Giftaway; Giftaway issues the voucher and redemption URL, which YAHOYA saves and displays. PAYDA processes related order references and status only where necessary for conversion reconciliation, support, fraud prevention, an eligible remedy or an applicable obligation. This does not require PAYDA to receive every voucher credential or the Member's entire YAHOYA history. Redemption status is processed where available from the merchant or provider.

Voucher codes, QR codes, PINs and redemption links require protection because they may allow redemption. Access and disclosure shall be limited to what is necessary for delivery, authorized redemption, investigation or support. KYC documents are not routinely shared merely because a voucher is purchased.

5.3 Refund Requests and Bank Details

PAYDA processes the requested refund amount, reason and supporting documents where needed, related funding and order references, eligibility and available-balance checks, verification results, review notes, approval or rejection and reasons, request and processing dates, status changes, and Member communications.

For a bank refund, we process the registered bank name or code, account number, account-holder name and evidence necessary to verify that the account belongs to the Member. Following approval, authorized PAYDA personnel use the necessary payment details to process the refund through online banking or another approved channel. We retain relevant payment references, confirmation or failure records and reconciliation results. Where the original funding channel is used instead, we process the identifiers needed for that return.

Approval of a request and completion of bank payment are separate events. Refund data is used to return eligible value to the Member, not to provide a third-party beneficiary transfer service. PAYDA does not require your personal online-banking password, PIN or bank OTP for this process; do not include these in documents or support messages.

6. DEVICE AND TECHNICAL INFORMATION

When you use PAYDA, certain information may automatically be collected, including:

• IP address
• Device type
• Operating system
• Operating-system version
• Application version
• Browser type
• Screen resolution
• Device identifiers
• Advertising identifiers, where applicable
• Mobile network information
• MCC/MNC information
• LTE/Wi-Fi information
• Network connection type
• Date and time of access
• Login records
• Authentication records
• Device registration information
• Application crash information
• Performance information
• Security logs
• Fraud indicators

PAYDA uses this information primarily for service operation, security, fraud prevention, troubleshooting, analytics, and regulatory purposes.

7. LOCATION INFORMATION

PAYDA may collect location information where:

• you grant the applicable device permission;
• the feature requires location information; or
• collection is otherwise permitted or required by law.

Location information may be used for:

• fraud prevention;
• transaction-risk assessment;
• account security;
• service functionality;
• regulatory compliance;
• security investigations; and
• other purposes disclosed at the time of collection.

You may disable location permission through your device settings. Certain services may not function when location permission is disabled.

8. APP PERMISSIONS

Permissions are requested only for supported features you use and for a stated purpose. Device permission does not replace the need for a lawful basis for processing.

• Camera: capture verification documents or scan a supported funding or voucher QR code where that feature is available.
• Photos or storage: select documents or payment evidence, attach support files, or save an issued voucher image. Access shall be limited to what the feature requires.
• Location: where collected, for the disclosed security, fraud-prevention or location-dependent purpose described in Section 7.

You may manage permissions in your device settings. Declining a permission may prevent the particular feature that needs it from working; optional permissions are not blanket conditions for unrelated Services. This policy does not authorize collection for unavailable transfer or remittance features.

9. COOKIES AND SIMILAR TECHNOLOGIES

PAYDA may use cookies, SDKs, pixels, local storage, and similar technologies.

These technologies may be used for:

• authentication;
• session management;
• security;
• fraud prevention;
• remembering preferences;
• analytics;
• application and website performance;
• service improvement; and
• relevant communications or advertising where permitted.

You may control cookies through your browser or device settings.

Disabling certain cookies may affect the functionality of some PAYDA Services.

10. HOW WE COLLECT PERSONAL INFORMATION

PAYDA may collect personal information:

1. Directly from you during account registration;
2. During identity verification and KYC;
3. When you conduct transactions;
4. When you register and verify bank details for a refund;
5. Through the PAYDA website and web application;
6. Through Voucher Providers providing issuance, delivery or redemption status;
7. Through banks and financial institutions;
8. Through payment service providers;
9. Through KYC and identity-verification providers;
10. Through fraud-prevention and security providers;
11. Through participating merchants for redemption, support or reconciliation;
12. Through customer-support interactions;
13. Through government or regulatory sources where lawfully available; and
14. Automatically through your device and use of PAYDA Services.

11. PURPOSES OF PROCESSING PERSONAL INFORMATION

PAYDA may process personal information for the following purposes.

11.1 Account Management

• Creating and maintaining PAYDA Accounts;
• verifying account information;
• authenticating Members;
• maintaining account security;
• providing account services; and
• managing Member profiles.

11.2 Funding, Purchase Balance and Reviewed Refunds

• confirming receipt of funding and recording Purchase Balance;
• authorizing account linking and conversion, recording PAYDA reservations or debits and reconciling YAHOYA point credits;
• receiving and reviewing refund requests and supporting evidence;
• verifying the Member's identity and ownership of the refund bank account;
• recording approval, rejection, review reasons and status notifications;
• processing approved refunds by authorized PAYDA personnel through online banking or an approved original funding channel;
• confirming payment and resolving failed or returned refunds;
• reversals;
• settlement;
• reconciliation;
• transaction verification; and
• fee calculation.

11.3 KYC and Customer Due Diligence

• Identity verification;
• customer identification;
• customer due diligence;
• enhanced due diligence;
• account-risk assessment;
• beneficial-owner identification;
• source-of-funds verification;
• source-of-income verification; and
• compliance with financial regulations.

11.4 AML/CFT Compliance

PAYDA may process information to:

• prevent money laundering;
• prevent terrorist financing;
• conduct transaction monitoring;
• detect suspicious transactions;
• perform sanctions screening;
• investigate unusual transactions;
• conduct enhanced due diligence;
• comply with AMLC requirements; and
• submit reports required by law.

11.5 Fraud and Security

Information may be processed to:

• detect unauthorized transactions;
• prevent account takeover;
• detect fraudulent activity;
• investigate scams;
• detect abnormal transactions;
• protect PAYDA systems;
• protect Members; and
• maintain payment-system security.

11.6 Customer Support

Information may be used to:

• answer inquiries;
• investigate complaints;
• investigate unauthorized transactions;
• resolve disputes;
• provide technical support; and
• maintain customer-support records.

11.7 Legal and Regulatory Compliance

PAYDA may process information to comply with:

• Philippine laws;
• BSP requirements;
• AMLC requirements;
• NPC requirements;
• court orders;
• lawful government requests;
• tax requirements;
• accounting requirements;
• audit requirements; and
• other regulatory obligations.

11.8 Service Improvement

PAYDA may use information to:

• improve PAYDA Services;
• analyze service usage;
• improve security;
• troubleshoot technical issues;
• develop new features; and
• conduct aggregated or de-identified analytics.

11.9 eGift and Digital Voucher Services

YAHOYA handles eGift selection, YAHOYA Points deductions and Giftaway purchase requests. PAYDA processes only related information necessary for its conversion, reconciliation and support responsibilities. The connected process uses necessary information to:

• authenticate conversion requests and correlate them with YAHOYA orders where necessary;
• check and reserve or debit PAYDA Purchase Balance for conversion, with YAHOYA separately recording point credits and purchase deductions;
• allow YAHOYA to send necessary purchase and delivery information to Giftaway;
• allow Giftaway to issue vouchers and redemption URLs and YAHOYA to save and display them;
• receive redemption status where available and necessary;
• prevent duplicate issuance, deduction, or refund;
• manage failed or uncertain transactions;
• process reversals and refunds;
• conduct settlement and reconciliation;
• resolve complaints;
• prevent fraud; and
• maintain transaction records.

12. LAWFUL BASES AND REGISTRATION CHOICES

PAYDA identifies a lawful basis for each processing activity and limits collection and use to what that purpose requires.

• Contract: processing ordinary personal information necessary to register and manage your account, confirm funding, maintain Purchase Balance, link the requested account, authorize and reconcile point conversion, coordinate the requested YAHOYA voucher service, deliver requested support and process eligible refund requests.
• Legal obligation: processing required by an applicable law, such as tax or accounting records, lawful orders, or identity-verification and AML/CFT duties where they apply to the actual service and entity. A provider's involvement does not automatically make every regulatory requirement applicable to every Member.
• Legitimate interests: necessary and proportionate fraud prevention, account and system security, reconciliation and operational improvement, where permitted after assessing the impact on your rights and interests. You may object as provided by law.
• Consent: optional marketing and other processing for which PAYDA relies on consent. Consent must be specific, informed, freely given, recorded and capable of withdrawal.

Sensitive personal information, including applicable government-issued identifiers and KYC data, requires a condition permitted under Section 13 of the Data Privacy Act or another applicable law. Contract or legitimate interests alone do not authorize processing of sensitive personal information. PAYDA shall identify the applicable condition, obtain specific consent where relied upon, and provide the relevant collection notice.

12A. Privacy Notice, Consent and Registration Choices

Acceptance of the PAYDA Terms, acknowledgment of this Privacy Policy and optional marketing consent are separate choices. Acknowledgment confirms that the notice was made available; it does not grant blanket permission for unrelated processing. Optional marketing consent is not required to open an account, buy a voucher or request a refund.

If information is necessary for a requested transaction or a legal obligation and you do not provide it, PAYDA may be unable to provide that affected Service and shall explain the requirement where lawful. Withdrawing consent does not invalidate prior lawful processing or require deletion of records retained on an independent lawful basis. PAYDA shall explain any applicable basis for continued processing.

13. PAYDA AND SERVICE-PROVIDER RESPONSIBILITIES

Bentix Global Solutions Inc. operates both PAYDA and YAHOYA PH and acts as Personal Information Controller for processing whose purposes and means it determines across these connected services. PAYDA handles registration, KYC, funding, Purchase Balance, conversion authorization and debits, refund review and support. YAHOYA handles its account records, point credits, purchase deductions, orders and voucher display. YAHOYA uses PAYDA KYC verification for the connection; this does not require routine copying of full KYC documents into YAHOYA. Access between the platforms is limited to information necessary for authorized account linking, conversion, fulfillment, reconciliation, support and other disclosed lawful purposes. Their separate systems and records do not remove Bentix's accountability. Netbank, Giftaway and other external providers retain their responsibilities under their actual roles and applicable arrangements.

Banks and payment providers receive the information needed to verify funding, process an approved refund, confirm payment, reconcile records or comply with their own applicable legal duties. Using their collection, settlement or online-banking infrastructure does not automatically establish a personal bank account for the Member.

Voucher Providers and merchants process the information needed for the particular order, delivery, validation, redemption, support or remedy. A provider acting only on PAYDA's instructions is a processor; a provider that independently determines its own purposes and means may be a separate controller. The role depends on the actual arrangement, not its label.

Netbank (A Rural Bank) Inc. participates in the VCA funding channel, receives funding into the linked corporate collection account and supplies incoming-transaction and settlement information to PAYDA. Giftaway receives purchase requests from YAHOYA and processes necessary information to issue vouchers and redemption URLs. These parties remain responsible for processing under their actual roles. Separate customer-facing bank or e-money products require their own relevant disclosures; this notice does not enroll a Member in such products.

PAYDA remains accountable for processing under its control and shall apply appropriate contractual and security safeguards when engaging processors or sharing information with another controller.

14. SHARING OF PERSONAL INFORMATION

PAYDA does not sell personal information. Sharing must have an appropriate lawful basis, specified purpose and safeguards and be limited to the information needed for that purpose.

For PAYDA ↔ YAHOYA account linking and conversion, only necessary account identifiers, authorization or verification status, amounts, conversion rate and fee information, transaction references, reservation or debit confirmations, destination-credit results and reconciliation or dispute records are exchanged. For YAHOYA → Giftaway purchases, only necessary order identifiers, product, amount and required delivery details are sent; issuance and redemption information is returned where available. Full KYC documents, unrelated transaction history and refund bank details are not routinely sent to YAHOYA, Giftaway or merchants merely to complete a conversion or voucher purchase. Any additional disclosure needs its own specified purpose, lawful basis and safeguards.

• Banks and payment providers: payment references, amounts, payment-source or verification information where necessary, and the verified Member bank details needed for funding confirmation, approved refunds and reconciliation.
• Voucher Providers and participating merchants: the product, order or voucher reference, transaction amount and relevant issuance, delivery, redemption or support information needed for the order. Contact or delivery details are shared only where necessary for that product or delivery method.
• Identity-verification, fraud-prevention and security providers: the minimum identity, verification, transaction or technical information necessary for the disclosed verification or security purpose.
• Hosting, communications and support providers: data needed to operate systems, send service notifications and resolve requests under appropriate access controls and processing arrangements.
• Auditors, professional advisers and competent authorities: information necessary for a lawful audit, advice, legal claim, reporting duty or valid legal request.

14A. Voucher Providers and Participating Merchants

PAYDA shall not provide full KYC documents, government identification numbers, date of birth, address, refund bank details or unrelated account history merely because a provider or merchant fulfills a voucher. Any additional disclosure requires a specified lawful purpose, appropriate lawful basis and necessary safeguards.

Order and voucher identifiers should be used instead of direct identity information where they are sufficient. Sharing for issuance or redemption does not authorize unrelated marketing. Where a provider independently processes personal information, its applicable notice shall explain that processing.

15. DISCLOSURE WITHOUT SEPARATE CONSENT

Separate consent is not required where another applicable lawful basis permits the particular disclosure. Examples may include processing necessary to fulfill a requested order or approved refund, compliance with a valid legal obligation or court order, or proportionate security processing permitted under law.

Fraud prevention, investigation or a request from a third party does not by itself authorize unrestricted disclosure. PAYDA shall assess the recipient's authority, purpose, lawful basis and necessary scope and apply the additional protections required for sensitive or privileged information.

16. PERSONAL INFORMATION PROCESSORS

PAYDA may appoint third-party Personal Information Processors.

Processors may provide:

• cloud hosting;
• database services;
• KYC;
• identity verification;
• SMS;
• email;
• push notifications;
• fraud monitoring;
• cybersecurity;
• analytics;
• customer support;
• document processing; and
• payment technology.

PAYDA shall take reasonable steps to ensure that its processors process information only for authorized purposes and maintain appropriate safeguards.

17. CROSS-BORDER PROCESSING

Certain PAYDA service providers may process personal information outside the Philippines.

Where personal information is transferred outside the Philippines, PAYDA shall implement appropriate safeguards and comply with applicable Philippine privacy requirements.

Such safeguards may include contractual, organizational, technical, and security measures appropriate to the nature of the information and processing.

18. SENSITIVE PERSONAL INFORMATION

PAYDA may process sensitive personal information where permitted or required by applicable law.

This may include information contained in:

• government-issued identification;
• KYC documents;
• identity verification;
• AML/CFT investigations;
• regulatory records; and
• other legally required documentation.

Appropriate safeguards shall be applied to sensitive personal information.

19. FINANCIAL INFORMATION CONFIDENTIALITY

PAYDA treats financial and transaction information as confidential.

Access shall be limited to authorized personnel, systems, institutions, and service providers with a legitimate and lawful need.

Financial information may be accessed or disclosed when necessary to:

• process transactions;
• provide financial services;
• provide customer support;
• prevent fraud;
• perform AML/CFT monitoring;
• comply with law;
• comply with regulatory requirements; or
• investigate disputes.

20. TRANSACTION MONITORING

PAYDA may monitor account and transaction activity to protect the PAYDA ecosystem and comply with legal and regulatory obligations.

Monitoring may consider:

• transaction amount;
• transaction frequency;
• transaction velocity;
• funding and confirmation activity;
• refund requests, review and payment status;
• voucher purchase, issuance, redemption and reversal activity;
• verified refund account ownership and payment information;
• funding-source information where necessary;
• device information;
• IP information;
• account behavior;
• geographic indicators; and
• other lawful risk indicators.

Such monitoring may result in additional verification, temporary restrictions, transaction review, or other actions where permitted by law.

21. AML/CFT PROCESSING

PAYDA and relevant providers may process personal information to comply with applicable Philippine AML/CFT requirements.

This may include:

• customer identification;
• customer due diligence;
• enhanced due diligence;
• beneficial-owner verification;
• source-of-funds verification;
• source-of-income verification;
• transaction monitoring;
• sanctions screening;
• suspicious-transaction investigation;
• regulatory reporting; and
• recordkeeping.

Where applicable law prohibits disclosure of information relating to an AML/CFT report or investigation, PAYDA may be unable to provide details concerning the investigation.

22. RETENTION OF PERSONAL INFORMATION

PAYDA retains identifiable information only for as long as necessary for its specified purpose, an applicable legal obligation or the establishment, exercise or defense of a legal claim. Retention depends on the category of record and applicable requirements.

• Account and verification records: while needed to maintain the account and complete necessary verification, and thereafter only for applicable legal requirements, unresolved disputes or justified fraud investigations.
• Funding, VCA, account-linking, conversion, Purchase Balance, voucher and refund records: while needed to fulfill or reconcile funding, PAYDA reservations or debits, YAHOYA point credits and deductions, Giftaway issuance and related transactions, support valid vouchers and resolve refunds or disputes, followed by any applicable tax, accounting or legally required retention period.
• Refund bank details and supporting documents: while needed for the requested verification and payment, reconciliation and any applicable recordkeeping or claim requirement. Unnecessary supporting material shall not be retained indefinitely.
• Support and security records: for the period needed to resolve the issue or investigate the incident and address applicable legal claims or obligations.
• Consent and preference records: while needed to honor your choices and demonstrate compliance. A limited suppression record may be kept where necessary to respect an opt-out.

PAYDA shall review retained records and securely delete or anonymize them when no valid retention purpose remains. Access to records under a lawful hold shall be restricted. Bank or AML/CFT retention requirements apply only where legally applicable; this policy does not impose one blanket retention period on all information.

23. RETENTION AFTER ACCOUNT CLOSURE

Closing or unlinking an account does not immediately remove records necessary to reconcile VCA funding, pending conversions, PAYDA debits and YAHOYA credits, resolve failed or duplicate transactions, complete pending orders, preserve valid voucher rights, verify or pay eligible refunds or resolve complaints. PAYDA limits continued processing to the relevant purpose and lawful basis. Unlinking shall prevent new conversion requests through that link while preserving records needed to resolve existing transactions; it does not itself cancel a completed conversion or erase records held lawfully by another controller.

Records subject to an applicable legal retention duty or lawful hold remain protected for the required period. Other information shall be securely deleted or anonymized once no longer needed. Retained records shall not be used for unrelated marketing. Members may request information about retention or exercise their rights under Sections 27 and 28, subject to lawful limitations.

24. SECURE DESTRUCTION

When personal information reaches the end of its applicable retention period, PAYDA shall take reasonable steps to securely dispose of it.

Electronic information may be securely deleted or rendered irretrievable.

Physical records may be shredded, destroyed, or otherwise disposed of using appropriate security procedures.

25. SECURITY MEASURES

PAYDA implements reasonable and appropriate organizational, physical, and technical measures to protect personal information.

These may include:

• encryption in transit;
• appropriate encryption or equivalent safeguards for sensitive information;
• authentication;
• role-based access controls;
• access logging;
• security monitoring;
• vulnerability management;
• security testing;
• backup and recovery procedures;
• incident-response procedures;
• secure software-development practices;
• confidentiality obligations;
• employee security training;
• vendor security assessments; and
• periodic security reviews.

No electronic system can be guaranteed to be completely secure. PAYDA continuously evaluates and improves its security controls.

26. DATA BREACHES AND SECURITY INCIDENTS

PAYDA maintains procedures for identifying, investigating, containing, and responding to personal-data breaches and security incidents.

Where a breach is subject to mandatory notification, PAYDA shall comply with applicable notification requirements of the National Privacy Commission and other relevant Philippine regulators.

Where an incident affects a bank, payment provider, Voucher Provider, merchant or processor involved in PAYDA Services, PAYDA shall coordinate with the relevant parties and authorities as required, including notification to affected individuals where required by law.

27. YOUR RIGHTS UNDER THE DATA PRIVACY ACT

Subject to applicable law and lawful limitations, you may have the following rights:

Right to be informed

You have the right to know how your personal information is processed.

Right to access

You may request access to personal information concerning you.

Right to correct

You may request correction of inaccurate or outdated personal information.

Right to object

You may object to certain processing where permitted by law.

Right to withdraw consent

Where processing is based on consent, you may withdraw consent subject to applicable legal limitations.

Right to erasure or blocking

You may request deletion, removal, or blocking of personal information where permitted by law.

Right to data portability

Where applicable, you may request a copy or portability of personal information in accordance with Philippine law.

Right to lodge a complaint

You may lodge a complaint with the National Privacy Commission if you believe your privacy rights have been violated.

These rights are subject to exceptions and limitations under applicable law.

28. HOW TO EXERCISE YOUR PRIVACY RIGHTS

Members may submit requests concerning their personal information, including access, correction, objection, withdrawal of consent, erasure or blocking, and other rights available under Philippine law. Requests may be sent directly to the Data Protection Officer using the contact details below; use of general customer support or an active PAYDA login is not required.

PAYDA may request reasonable information necessary to verify the identity and authority of the requesting individual before disclosing, correcting or deleting personal information, to protect against unauthorized access or disclosure. Do not send passwords, PINs or OTPs with a privacy request.

Requests shall be evaluated and processed in accordance with applicable Philippine data-protection laws and lawful retention requirements. Where information must be retained on a lawful basis, a deletion request does not automatically require its immediate removal; PAYDA shall explain any applicable limitation where legally permitted.

29. CHILDREN'S PERSONAL INFORMATION

PAYDA Services are intended only for persons who are legally eligible to use the applicable service.

PAYDA may apply age and identity verification requirements appropriate to the financial service.

Where personal information concerning children is processed, PAYDA shall comply with applicable Philippine privacy laws and requirements.

If PAYDA becomes aware that personal information has been collected contrary to applicable requirements, PAYDA shall take appropriate action.

30. MARKETING COMMUNICATIONS

PAYDA may send marketing or promotional communications where permitted by applicable law and where the appropriate lawful basis exists.

Members may opt out of marketing communications through available unsubscribe mechanisms or account settings.

Opting out of marketing communications does not prevent PAYDA from sending necessary service communications such as:

• transaction confirmations;
• security alerts;
• fraud alerts;
• account notices;
• regulatory notices;
• service interruptions; and
• other necessary service communications.

31. PROFILING AND AUTOMATED PROCESSING

PAYDA may use automated systems, rules, analytics, and risk models for:

• fraud detection;
• transaction monitoring;
• cybersecurity;
• account security;
• AML/CFT monitoring;
• risk assessment; and
• service improvement.

Where applicable law requires additional safeguards regarding decisions that significantly affect a Member, PAYDA shall comply with such requirements.

Automated checks may flag inconsistent bank details, duplicate requests, insufficient available balance or suspicious activity for review. The refund model includes review by authorized PAYDA personnel before approved payment processing. Members may request review of an adverse refund decision or correction of inaccurate information through PAYDA's support and privacy channels. Any solely automated decision-making with significant effects requires the applicable disclosures and safeguards before use.

32. THIRD-PARTY INFORMATION

PAYDA may lawfully receive information from:

• Voucher Providers supplying order, issuance and redemption records;
• banks;
• financial institutions;
• KYC providers;
• identity-verification providers;
• payment providers;
• fraud-prevention providers;
• merchants;
• regulators;
• government agencies; and
• transaction counterparties.

Such information may be used for identity verification, transaction processing, fraud prevention, security, regulatory compliance, and other lawful purposes.

33. DATA ACCURACY

Members must provide accurate and current information.

Members should promptly update information when it changes.

PAYDA may rely on information provided by Members unless PAYDA has reasonable grounds to believe that such information is inaccurate or incomplete.

34. ACCOUNT AND AUTHENTICATION SECURITY

Members must protect:

• passwords;
• PINs;
• OTPs;
• authentication codes;
• registered devices;
• SIM cards;
• recovery information; and
• other authentication credentials.

Members must immediately report suspected unauthorized access or compromised credentials.

PAYDA personnel will not request passwords, PINs, or OTPs through unsolicited communications.

35. PHISHING, SCAMS AND FRAUD

Members should remain alert to:

• phishing;
• fake PAYDA websites;
• fake customer-support accounts;
• fraudulent messages;
• fraudulent links;
• impersonation;
• social engineering; and
• unauthorized requests for OTPs or account credentials.

PAYDA will not request Members to disclose their passwords or OTPs through unsolicited communications.

Suspected fraud or unauthorized transactions should be reported immediately through official PAYDA support channels.

36. THIRD-PARTY SERVICES AND LINKS

PAYDA may provide links to third-party websites or services.

Third parties may have their own privacy policies.

PAYDA is not responsible for the privacy practices of independent third parties.

Members should review applicable third-party privacy notices before providing personal information.

37. PROVIDER PRIVACY NOTICES

Where a bank, payment provider, Voucher Provider or merchant independently determines how and why it processes personal information, its privacy notice applies to that processing. PAYDA shall identify the relevant provider and make applicable privacy information available in connection with the service.

Netbank's privacy notice and product documentation apply only to processing or products it actually provides. PAYDA registration does not automatically open a Netbank account or constitute consent to unrelated provider processing.

A provider notice does not remove PAYDA's own privacy obligations. You may contact PAYDA about disclosures it makes and the relevant provider about processing under that provider's independent control.

38. CONSUMER PROTECTION AND PRIVACY COMPLAINTS

Members may raise privacy concerns about PAYDA registration, KYC, VCA funding, linked-account information, point conversion, reconciliation and refunds through PAYDA's privacy and complaint channels. YAHOYA handles privacy inquiries about its own points, orders and voucher display under its applicable notice; Giftaway and merchants handle processing under their respective roles. PAYDA shall coordinate related concerns where necessary and remain responsible for its own processing. Members are not required to resolve internal reconciliation between providers themselves.

Bentix Global Solutions Inc. remains the responsible Personal Information Controller for processing under its control across PAYDA and YAHOYA PH. Members may submit privacy inquiries or requests relating to either platform to Bentix's designated Data Protection Officer using the contact details provided in this Privacy Policy.

Consumer remedies under the PAYDA Terms and Philippine law remain available. Privacy complaints may be brought to the National Privacy Commission. Where a concern involves an actual product or service of a BSP-supervised institution, its complaint process and applicable BSP assistance channels may also be available.

39. CHANGES TO THIS PRIVACY POLICY

PAYDA may update this Privacy Policy when necessary because of:

• changes in law;
• regulatory requirements;
• changes in PAYDA Services;
• changes in funding, account-linking, conversion, YAHOYA, Giftaway, merchant or refund-provider arrangements;
• changes in technology;
• changes in data-processing practices; or
• other legitimate operational requirements.

For material changes, PAYDA shall provide appropriate notice in accordance with applicable law.

The revised policy shall state its effective date. PAYDA shall explain material changes in purposes, data categories or recipients and obtain fresh consent where legally required. Continued use or acknowledgment of a revised notice does not substitute for consent where consent is required.

40. DATA PROTECTION OFFICER

For privacy concerns, requests, complaints, or questions, please contact:

41. NATIONAL PRIVACY COMMISSION

If you believe your privacy rights have been violated, you may contact the National Privacy Commission of the Philippines or file a complaint in accordance with applicable procedures.

PAYDA encourages Members to contact the PAYDA Data Protection Officer first so that the concern can be investigated and resolved where possible.

42. BSP FINANCIAL CONSUMER CONCERNS

For concerns involving financial products or services provided by a BSP-supervised institution actually involved in the service, Members may first use the applicable financial institution's complaint-handling process.

Where appropriate and permitted, unresolved financial-consumer concerns may be elevated to the Bangko Sentral ng Pilipinas through its applicable consumer-assistance channels.

43. CONTACT INFORMATION