Data Privacy and Protection Notice

SM Savings and Loan Association, Inc. (hereafter “SM SLA”) complies with the standards and requirements set forth by Republic Act (R.A.) No. 10173, otherwise known as the Data Privacy Act (DPA) of 2012, its Implementing Rules and Regulations, and other data privacy guidelines issued by the National Privacy Commission (NPC) or other relevant government agencies.

At SM SLA, we value your personal information and data privacy rights.

Member Information and Purpose of Use

SM SLA will collect, process, store, record, organize, update, modify, block, erase, and destroy (collectively referred to as “processing” under Republic Act No. 10173 and its Implementing Rules and Regulations, otherwise known as the “Data Privacy Act of 2012”) members’ personal information (as shown below) for the following purposes:

SM SLA operations [e.g. membership profile, accounts management, loans management, billing & collection, and other business operations];
Research and business development or other initiatives to further improve or update product lines or service delivery;
For promotions or marketing initiatives through mail, e-mail, SMS, telephone, or any other means of communication; and
Collection of loans and receivables, past due and written-off accounts; and (e) payment of loan proceeds and other disbursements.

For the above purposes, we may collect or receive all or some of the following categories of personal information:

Biometrics and other information that are unique to an individual, such as: name, age, sex/gender, date and place of birth, civil status, date of marriage, TIN, GSIS or SSS number, nationality, mother’s maiden name, and other identification document details/images, photos, signature, thumb print;
Contact information, such as: telephone and mobile numbers, present and permanent addresses, work or office address, email addresses, and social media accounts;
Financial, employment, service and business information, such as: source of income or fund, salary or payslip data, branch of service, pay jurisdiction, rank/position, serial number, unit assignment, designation, date of appointment, date of retirement, job, occupation, profession, line of business, licenses, permits, tax reports;
Certifications/Orders, such as: Birth Certificate, Marriage Contract, Certificate of Employment and Compensation, Certificate of Pension, Appointment Order, Call to Active Duty, Retirement Order;
Beneficiary/ies information, such as: name, age, birthdate, addresses, and source/s of fund;
All other personal information as may be required, such as: Know-Your-Customer data and documentation, other accounts/business on-boarding requirements, IP addresses when accessing the SM SLA Website; and
Updates or corrections of the above necessary and compatible with the purposes for which personal information was obtained or received.

Consent

The consent of an SM SLA member is documented through our forms (e.g. Membership Application Form, Loan Application Form, Withdrawal Slip, etc.) for the processing of personal information. Such consent, however, will automatically expire ten (10) years from the member’s last transaction with SM SLA (e.g. termination of membership and closure of accounts).

Data Sharing

SM SLA shares the personal information of members to its authorized third parties, such as: its service group, government agencies (e.g. BSP, AMLC, SEC, BIR, other judicial bodies), collection agents, accredited banks, and other contractors. Any data sharing for commercial purposes shall be covered by a Data Sharing Agreement.

How Long Do We Retain Your Personal Information?

We will keep the personal information we collect about you for as long as necessary to carry out the Purpose of Use set forth in this Privacy Notice or in accordance with prescribed retention periods under relevant regulations (e.g. BIR). We may also retain your personal data in order to enforce our legal rights or whenever it is required under the DPA or upon lawful order of a competent court or relevant government agency.

How Do We Dispose Your Personal Information?

Electronic files shall be erased, while physical records shall be shredded for disposal. When appropriate, anonymization techniques may be performed to permanently remove identifiable information from our records. In all cases, we will make sure that the personal information is destroyed in a way that prevents unauthorized people from accessing, processing, or retrieving it.

What are the Risks Involved?

Risk is the chance that a harmful incident may happen. In the context of personal data, risk refers to the chance that someone might collect, use, disclose, or access your personal data in an unauthorized manner or in a way that may cause you harm. In order to ensure that the risks to your personal information are minimized, we employ various measures to safeguard your personal information. However, this does not guarantee protection against all threats such as when systems are exposed to targeted cyber attacks, malware, ransomware, and computer viruses or when manual records are accessed without authority. In case a security incident occurs, we’re prepared to respond and manage such incidents in line with our policies and in accordance with regulations.

Where Do We Store Your Personal Information?

Your personal data are stored in a secure facility in the Philippines or in other countries where we or our Business Partners have facilities. When we transfer your personal information to other countries, we comply with the requirements of DPA Legislation or relevant regulation for such transfer and take steps to ensure that your personal information is protected and processed in accordance with this Privacy Notice.

How Do We Protect Your Personal Information?

We implement industry-standard security measures to protect the confidentiality, integrity, and availability of the personal data that we process. These security measures include the following:

Organizational Security Measures

Appointing a Data Protection Officer;
Conducting data privacy training and periodic refresher sessions across the organization;
Instituting policies and procedures to safeguard personal data against any unauthorized or malicious access, alteration and disclosure;

Physical Security Measures

Storing physical records of personal data in a locked and secure place accessible only to authorized personnel;
Securely destroying records or files of personal data when such is no longer needed for any legal or business purpose;

Technical Security Measures

Implementing role-based access on our systems to ensure that only authorized personnel are granted access on a need-to-know basis;
Performing periodic reviews of access rights;
Deploying firewall equipment and similar network devices to protect our systems and network;
Storing your electronic data in a secure IT infrastructure and utilizing up-to-date technology products to prevent unauthorized computer access
Regularly running vulnerability scans on our systems and websites and performing other maintenance activities to ensure that your personal information is secure; and
Ensuring sensitive personal information are transmitted through secure channels and implementing encryption methods, whenever suitable.

Do We Use Cookies?

Our website collects device cookies to enable you to browse our website and to enable us to address your concerns and inquiry better. Cookies are small text files that are stored on your device when you visit our websites or use our apps. We utilize various cookies as described below.

Necessary cookies: These cookies are essential for the website to function properly. They allow you to browse our website and use its features, such as logging in and adding items to your shopping cart. Without these cookies, our site will not work the way it should.
Analytics cookies: These cookies collect information about how you use our website, such as the pages you visit and the links you click. This information is used to improve our website and to make it more user-friendly.
Functional cookies: These cookies remember your preferences, such as your language and font size. This allows us to provide you with a more personalized experience.
Performance cookies: These cookies collect information about how our website is performing, such as how many visitors we have and which pages are the most popular. This information is used to improve the performance of our website.
Advertisement cookies: These cookies are used to deliver advertising content that is relevant to you. The purpose is to provide you with customized ads based on your interest, search and browsing behavior.
Third-Party Cookies: Third-party cookies, such as those from Google Analytics and Facebook Pixel, are also utilized for measurement, analytics, and ad personalization purposes. These cookies help us gain insights into user behavior and enhance our services. For more details, please refer to the respective third-party websites.

Consent on Cookies

You may withdraw your consent by choosing the opt-out function in our cookie setting. However, by opting out of these third-party cookies, your browsing experience may be affected. You may also later opt-out from said third-party cookies after giving your consent by clearing your cookies and other site data in your browser settings.

What if You are a Minor?

SM SLA shall not knowingly collect the personal data of a person below 18 years old without any legal basis or consent of the minor’s parent/s or legal guardian. Should it come to our attention that the personal data of minors was provided without a legal basis or consent of the minor’s parent/s or legal guardian, such personal data shall be destroyed or deleted in a secure manner.

Minors are advised not to provide any personal data, such as their name, age, gender, email address, contact information, among others, and should consult their parent(s) or guardian(s).

What are Your Rights and Obligations?

You are responsible for ensuring that the personal data you provide is accurate and up-to-date and that you are of legal age when you submit any data to us.

We encourage you to use the latest version of web browsers for your own safety and security. Updated web browsers are normally equipped with security features that provide anti-phishing protection, improved parental controls, and tools to prevent malware and other privacy threats. We will not be liable for any damage, loss, injury, or claim that may result when you fail to comply with these obligations.

Please set and maintain your communication preferences so that we send communications to you in accordance with your preferences. You are not licensed or otherwise allowed to add other users to our mailing list (email or physical mail) without their express consent. You should not send any messages which contain spam, spyware or virus via the Website. If you would like to report any suspicious messages, please contact us at our email address provided on the latter part of this data privacy and protection notice.

As provided under the DPA, you have the following data privacy rights:

Right to be informed. You have the right to be informed of the collection and processing of your personal data, the purpose for which they will be processed, among others. Thus, you are required to read this privacy notice before giving your consent to the collection and processing of your personal data.
Right to object. You have the right to object to the processing of your personal data. You will be given an option or opportunity to withhold your consent to the processing of your personal data whenever SM SLA communicates with you.
Right to access your information. It is your right to obtain confirmation on whether or not data relating to you are being processed as well as other relevant information about the processing involved.
Right to updating or rectification. You have the right to rectify or correct any inaccuracy or error in your personal data by submitting your request for rectification or correction
Right to erasure or blocking. You have the right to the erasure or blocking of your personal data in accordance with the requirements of the DPA, subject to restrictions imposed by other regulations.
Right to damages. You have the right to be indemnified if you incur damages due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your personal data.
Right to data portability. You have the right to obtain a copy of your data in a structured and commonly used format by submitting a proper request.
Right to file a complaint. If you have reason to believe that your personal information has been misused, maliciously disclosed, or improperly disposed of or that your data privacy rights have been violated, you have the right to file a complaint.

If you intend to exercise any of your abovementioned data privacy rights you may contact our Data Protection Officer (DPO) through the contact details provided in the succeeding section.

How Can You Contact the DPO?

For inquiries regarding the processing of personal data, as well as any concerns or complaints regarding data privacy, or should you want to exercise your rights as a Data Subject, you may contact the DPO using the information below:

The Data Protection Officer
SM Savings and Loan Association, Inc.
6F Building A, SM Retail Headquarters
J.W. Diokno Boulevard corner Seaside Avenue
MOA Complex, Pasay City 1300
Tel: (+63) 9178470835

Email: [email protected]

We encourage you to submit your inquiry and/or concerns in writing for proper documentation and tracking. Our response will be within 15 days upon receipt.

How Will You Know if this Privacy Notice Changes?

SM SLA may change this Privacy Notice from time to time without prior notice. Revised versions of this Privacy Notice will be posted on this page, together with an updated effective date.

Last updated on 01 July 2024.