Effective as of 09 October 2023

Bukas Finance Corp. (alternatively referred to as “Bukas”, “the Company”, “we”, “us” or “our”) is a corporation duly organized and existing under the laws of the Philippines and is part of the Erudifi Group of Companies. Bukas, its assigns, affiliates, and related companies ("ErudiFi Group"), are committed to protect and respect your personal data privacy and in complying with the provisions of the Data Privacy Act of 2012 and its implementing rules and regulations.

This privacy policy (“Privacy Policy”) sets out the basis on which we, our assigns, affiliates and, related companies, will collect, process, store, disclose and protect any Personal Information we collect from you or that you provide to us in connection with the use of our Site, with the products and services (collectively known as “Services”) that we offer, or with any other interaction with us (for example, by attending our events).

Our Site and Services entail that you provide us with information we can use to better understand you as a student, parent or guardian. Your privacy is our outmost concern and we will ensure that it will always be respected.

This policy is intended to help you understand:

• Information We Collect and Receive
• How We Use Information
• How We Share and Disclose Information
• How We Store and Secure Information
• How to Access and Control your Information
• Other Important Privacy Information

Recitals

1. By using the Site and/or providing Personal Information to us, you signify that you have read, understand, and agree to be bound by the Privacy Policy, and consent to the collection, use, and processing and disclosure of your Personal Information. Please read the Privacy Policy very carefully. If you do not wish to be bound by Privacy Policy, you should not access or use the Site or Services.
2. Without prejudice to any of the foregoing, if you provide the Personal Information of any other third party to us, it shall be your responsibility to inform such third party. You warrant and agree that such third party has fully read and understood this Privacy Policy, and has consented to you disclosing his/her Personal Information to us for the collection, use and disclosure by us as described in this Privacy Policy.

Information We Collect and Receive

We collect information about you when you provide it to us, when you go to our Site or use our Services, and when other sources provide it to us, as further described below.

Personal Information: Bukas may collect and process the following information about you through your use of the Site or Services. This may include, but is not limited to:

• Information to identify you (e.g. your full name, government issued ID, facial image or photographs, date of birth, marital status, gender)
• Contact Information (e.g. mobile or telephone number, email address, permanent and present address)
• School Information (e.g. your school, degree or course, and copies of your school ID’s other identification evidence that you provide, including school enrollment forms and official school billings)
• Other educational information (e.g. grades, previous payment history, unpaid balances)
• Employment information (e.g. employer name and address, job industry and position, job employment date, monthly income)
• A parent or guardian’s
  • Identification information (e.g. full name, address, marital status, gender, copies of any government-issued identification)
  • Contact Information
  • Employment information
• Social media accounts that you provide
• Geolocation based on your mobile

Financial Data: Bukas may collect payment behavior and credit capacity and other financial data when you use our Services like:

• Details of transactions you carry out through our Site including application progress from registration to loan activation;
• The financial products you have with Bukas, including the fulfillment of your loan repayments, the payment channels you use to pay us, your payment arrears;
• Financial and employment information on your or your parents or guardian's income.

Information from Schools: With your consent, we may collection the above Personal and Financial Information through your school, training or educational programs. Your school may also provide the above Personal and Financial you when you apply for a Bukas all-in installment or wholesale plan for the purpose of processing your loan application and verifying the data you have provided. This may also include:

• Mobile number
• Degree, course, year level
• Grades (most recent semester)
• Outstanding tuition fees (current and/or previous semester)
• Student ID Number and Photo
• Method of Payment of Previous Semester
• Status of Past Payments (on time, late)
• Guardian First Name
• Guardian Last Name
• Guardian Mobile Number

Information from Various Services, Networks, Credit Bureaus: We may receive information about you from other third party sources such as data from public sources, credit references, debt collection and fraud protection agencies, financial institutions or companies, telecommunication companies, credit bureaus and other data aggregators to help us with customer verification and credit-related decisions

Interactions on the Internet and Social Media: We may follow public profiles, messages, posts, likes and responses to and about Bukas on the internet. We may also use any social media that you have, whether this is provided to us or through our own search efforts, to contact you. We may also gather public information that you place on the internet and other social media accounts.

Information Through Surveys of Customer Support: Bukas can also collect information when you participate in any survey, or provide feedback or problem you are experiencing on our website. This may include:

• Records of any surveys, contests, events, campaigns, that we may ask you to complete for research or marketing purposes;
• Information regarding a problem you are experiencing with a Service, including a summary of the problem you are experiencing, and any other documentation, screenshots or information that would be helpful in resolving the issue.

Log Data: Bukas collects information that your browser sends whenever you visit our Site ("Log Data"). This Log Data may include information such as your computer's Internet Protocol ("IP") address, browser type, browser version, pages of our Site that you visit, the time and date of your visit, the time spent on those pages and other statistics. In addition, Bukas may use third party services that collect, monitor and analyze these information.

Cookies: Cookies are files with small amount of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a web site and stored on your computer's hard drive. Like many sites, Bukas uses "cookies" to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of this Site.

How We Use the Personal Information

You may be asked to provide your Personal Information anytime you are using the Site or Services. Bukas uses this information to understand and analyze trends, to administer the site, to learn about user behavior on the site, to improve its Services, and to gather demographic information about its user base as a whole. Below are some specific purposes for which we use the information we collect about you.

To provide the Services: We use information about you to provide the Services to you, including to process transactions with you, authenticate you when you log in, provide customer support, and operate and maintain the Services. We may also use this information to offer any additional product or service.

For research and development:  We use information about you to perform data analysis for product improvement and testing, to improve credit risk models, and for the creation of statistical models. We use collective learnings about how people use our website and feedback provided directly to us to troubleshoot and to identify trends, usage, activity patterns and areas for integration and improvement of the Services.

For Automated decisions, Profiling and Artificial Intelligence Use. We may employ automated decision-making processes or profiling techniques as part of our evaluation and processing of loan applications. These processes may involve the use of algorithms, statistical models, and other automated tools to analyze Personal Information and assess creditworthiness. These automated decisions or profiling may have significant effects on individuals, such as determining loan eligibility, interest rates, and credit limits. Please note that while automated decision-making and profiling are utilized, they do not replace the option to seek assistance throughout the loan application.

If you do not agree with us using your Personal Information for such purposes, you can send a written request to us. Please note should you wish to object to the usage of your Personal Information in this way, we may not be able to continue to offer you or Services, in which case we may need to terminate our relationship in order to fulfill your request.

To communicate with you about the website: We use your contact information to send transactional communications via email or text and within the website, including responding to your comments, questions and requests, providing customer support, and sending you technical notices, updates, security alerts, and administrative messages. If an opt out is available, you will find that option within the communication itself or in your account settings.

To market, promote and drive engagement with the website: We use your contact information and information about how you use the Services to send promotional communications that may be of specific interest to you, including by email or text, as well as on platforms like Facebook, Google, Viber and the like. These communications are aimed at driving engagement and maximizing what you get out of the Services, including information about new features, survey requests, newsletters, and events we think may be of interest to you. We also communicate with you about new product offers and promotions. You can control whether you receive these communications as described below under "Opt-out of communications."

Customer support: We use your information to resolve technical issues you encounter, to respond to your requests for assistance, to analyze crash information, and to repair and improve the Services.

For safety and security: We use information about you and your Service use to verify accounts and activity, to monitor suspicious or fraudulent activity and to identify violations of Service policies.

To protect our legitimate business interests and legal rights: Where required by law or where we believe it is necessary to protect our legal rights, interests and the interests of others, we use information about you in connection with legal claims, compliance, regulatory, and audit functions, and disclosures in connection with the acquisition, merger or sale of a business.

With your consent: We use information about you where you have given us consent to do so for a specific purpose not listed above.

How We Share and Disclose Information and Why

We work with third-party entities who help us provide and improve our Services or who use advertising or related products, which makes it possible to operate and provide free services to our users. Here are the types of third parties we can share information with about you:

Schools: We partner with schools and universities to provide our Services to its students. As such, we share information about you to these institutions, with your consent, in order to provide our Services to you.

We do not share information that personally identifies you (personally identifiable information is information like name or email address that can by itself be used to contact you or identifies who you are) with institutions, unless you give us permission or when necessary for the Conduct of the Company’s business.

If you want more information about how we share information to the schools, please read our Terms & Conditions.

Affiliates, and Related Companies: We are part of a group of companies owned by ErudiFi, Pte. Ltd. (formerly known as "Dana Cita Pte. Ltd.") a corporation duly organized and existing under the laws of Singapore ("ErudiFi Group"). We can transfer information to our affiliates and related company who provide us, among others, technical infrastructure services. In receiving your personal information, our affiliates and related companies agree to be bound by the provisions of the Data Privacy Act of 2012 and its implementing rules and regulations.

Vendors service providers and other partners: We transfer information to vendors, service providers, and other partners who support our business, such as providing technical infrastructure services, analyzing how our Services are used, measuring the effectiveness of ads and services, providing customer service, facilitating payments or payment processing (including, in the event of default, external debt collection agencies and lawyers), or conducting academic research and surveys. These partners must adhere to strict confidentiality obligations in a way that is consistent with this Privacy Policy and the agreements we enter into with them.

Credit Bureaus or Credit Reporting Bodies: We may/will need to disclose information to third parties such as credit bureaus or credit reporting bodies for the purpose of determination of creditworthiness, conducting all the necessary background checks that may include credit scoring, verification and and investigation, and data analytics for fraud detection, investigation, and prevention, including complying with eKYC (Know Your Customer) regulations required by the Securities and Exchange Commission and the Anti-Money Laundering Council.

Parents, Guardians, Guarantors, Co-Borrowers. We may share information to any person who has told us and who we reasonably believe to be your parent, legal guardian, guarantor or co-borrower, when proof is presented that you are unable to handle your own affairs because of death, mental incapacity or other similar issues for the purpose of proper handling of said affairs

Assignees, Transferees or Purchasers. We may share transfer information to any person to whom we sell or transfer (or enter into negotiations to sell or transfer) our business or any of our rights or obligations under any agreement we may have with you. If the transfer or sale goes ahead, the transferee or purchaser may use your Personal Information in the same way as us.

With your consent: We share information about you with third parties when you give us consent to do so, such as when you enter into a Loan Agreement with us, or when you agree to provide us testimonials.

Compliance with Enforcement Requests and Applicable Laws; Enforcement of Our Rights: In exceptional circumstances, we may share information about you with a third party if we believe that sharing is reasonably necessary to (a) comply with any applicable law, regulation, legal process or governmental request, including to meet national security requirements, (b) enforce our agreements, policies and terms of service, (c) protect the security or integrity of our products and services, (d) protect Bukas, or our customers or the public from harm or illegal activities, or (e) respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing the death or serious bodily injury of any person.

For more information about how we may share or disclose your information, please refer to our Terms of Use.

How We Store and Secure Information

Information security: We use Google Cloud servers in Singapore to host the information we collect, and we use technical measures to secure your data. While we implement safeguards designed to protect your information, no security system is impenetrable and due to the inherent nature of the Internet, we cannot guarantee that data, during transmission through the Internet or while stored on our systems or otherwise in our care, is absolutely safe from intrusion by others.

How long we keep information: How long we keep information we collect about you depends on the type of information. After such time, we will either delete or anonymize your information or, if this is not possible (for example, because the information has been stored in backup archives), then we will securely store your information and isolate it from any further use until deletion is possible.

How to Access Your Information

You have certain choices available to you when it comes to your information. Below is a summary of those choices, how to exercise them and any limitations.

Your Choices: You have the right to request a copy of your information, to object to our use of your information (including for marketing purposes), to request the deletion or restriction of your information, or to request your information in a structured, electronic format. You may send these requests to our Data Protection Officer at [email protected] You will receive notice and/or confirmation on the status of these requests.

Your request and choices, however, may be limited in certain cases: for example, if fulfilling your request would reveal information about another person, or if you ask to delete information which we or our administrator are permitted by law or have compelling legitimate interests to keep. In addition, we will still process and share in the instances provided under applicable law, rules and regulations, such as, but not limited to:

1. if the Personal Information is needed pursuant to a subpoena;
2. if the collection and processing is necessary for the performance of or in relation to the contract or service between you and us, such as, but not limited to, your continued use of our Service; and
3. the Personal Information is collected and processed as a result of a legal obligation on our part.

Access, update, or delete your information: Our Services and related documentation give you the ability to access, update, or delete certain information about you from within the Service. Please note, however, that we may need to retain certain information for record keeping purposes, to complete transactions or to comply with our legal obligations.

Request that we stop using your information: In some cases, you may ask us to stop accessing, storing, using and otherwise processing your information where you believe we don't have the appropriate rights to do so. You may send these requests directly to our Data Protection Officer at [email protected].

Opt out of communications: You may opt out of receiving promotional communications from us by using the unsubscribe link within each email, updating your email preferences within your account settings menu, or by contacting us as provided below to have your contact information removed from our promotional email list or registration database. Even after you opt out from receiving promotional messages from us, you will continue to receive transactional messages from us regarding our Services. You can opt out of some notification messages in your account settings.

Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the right to be informed regarding processing the Personal Information we hold about you.

Further, you may be entitled to request:

1. Access to personal data we process about you. It is your right to obtain confirmation on whether or not data relating to you are being processed;
2. Rectification of your personal data. This is your right to have your personal data corrected if it is inaccurate or incomplete;
3. Erasure or order blocking of your personal data whenever warranted;
4. The right to object if the personal data processing involved is based on consent or on legitimate interest;
5. The right to data portability through which you may obtain and electronically move, copy, or transfer your data securely for further use.

You may claim compensation if you believe you suffered damages due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data or for violating your rights and freedoms as a data subject.

Suppose you think that your Personal Information has been misused, maliciously disclosed, or improperly disposed of or that your data privacy rights have been violated. In that case, you have a right to file a complaint with the NPC.

Other Important Privacy Information

Changes to our Privacy Policy: This Privacy Policy is effective as of 09 October 2023 and will remain in effect except with respect to any changes in its provisions in the future, which will be in effect immediately after being posted on this page. Bukas reserves the right to update or change its Privacy Policy at any time and you should check this Privacy Policy periodically. Your continued use of the Service after Bukas posts any modifications to the Privacy Policy on this page will constitute your acknowledgment of the modifications and your consent to abide and be bound by the modified Privacy Policy. If Bukas makes any material changes to this Privacy Policy, Bukas will notify you either through the email address you have provided us, or by placing a prominent notice on our website.

Contact Us: you have any questions about this Privacy Policy or to communicate with our Data Protection Officer, please contact us at [email protected]