SOC 2 Type 2

CIBI Information Inc. is committed to handling personal and sensitive data in compliance with the Data Privacy Act of 2012, its IRR, and the issuances of the National Privacy Commission. If you want to file a complaint for any privacy violation under the law, please be guided by the procedures below:

A. Types of Complaints Concerned

All complaints about CIBI’s processing of Personal and Sensitive data will be handled in line with the procedure set out in HANDLING COMPLAINTS below. Examples of the types of complaints that may be raised by the data subject may include the following:

1. Unfair or unlawful processing of personal data
2. Misuse of your personal data
3. Unauthorized access to your personal data
4. Loss or deletion of your personal data

B. Handling Data Subject’s Complaints

CIBI will engage positively and resolve your complaint satisfactorily without you having to refer your complaint to the National Privacy Commission. Please take note that under Section 4 of NPC Circular 16-04 Rules of Procedure, the data subject is required to notify CIBI of any form of personal data breach and be given an opportunity to address the such breach. To help us deal with your complaint, please provide a full written explanation of your concerns by completing the Data Protection Complaint Form below and following the steps as provided.

C. Steps in Filing a Complaint

Step 1: Complete and submit the Complaint Form and send it to the Data Protection Officer at the email address: dpo@cibi.com.ph.

Step 2: To assist us in dealing with your complaint, please provide the following:

a. Full name and any government-issued IDs or passport of the person lodging the complaint;
b. A clear photocopy of the IDs or passport

Step 3: You will receive a communication within three (3) business days from CIBI’s acknowledgement of receipt of your complaint.

Step 4: Your complaint will be treated confidentially and fully investigated where necessary. During this process, you may receive additional communications from our data protection officer to investigate your concern. If you have not provided enough information in your complaint, we will let you know the further information needed to process your complaint.

Step 5: Once the information related to your complaint is complete, we will contact you within thirty (30) days to propose a solution. This deadline may be extended in certain circumstances, depending on the nature of the complaint.

Step 6: If the solution proposed resolves your complaint, the Data Protection Office will close the matter.

Step 7: Should you remain unsatisfied with the outcome of the review by the Data Protection Officer or you have not received an answer within the above-mentioned deadline, you may then seek further recourse by contacting our President and CEO at _____________________________.

REPORTING A BREACH FORM

Data Subject Rights Form

CIBI Information Inc., in compliance with Section 12 of the Data Privacy Act of 2012 on the criteria of lawful processing of personal information, shall strive to acquire the consent of data subjects prior to the processing of its personal data. However, if the acquisition of consent proves to be challenging and/or impractical, we, in CIBI shall commit to process data only according to the following legitimate interests of our clients:

CIBI Services	Legitimate Interests of Clients
Know Your Customer (KYC) Pre-Employment Verification Full Individual Report Directorship Negative Records	Due Diligence	Clients want to conduct further and necessary corporate due diligence on customers, potential customers and business partners, which may include consolidating official watch lists, sanction lists, crime watches and ‘do not do business with lists’
	Fraud Detection and Prevention	Prevent fraud by validating the genuineness and authenticity of the declarations made by an individual
	Background Checks	Clients want to process personal data to undertake background vetting of people it has been given job offers or are about to be given job offers. This includes asking for references from previous employers. The client ensures potential employees are fully aware that this processing of their personal data will take place.
	Risk Assessment	Clients need to risk assess potential customers to determine what products or services they can offer and the terms of services.
Credit Report/Score	Artificial Intelligence and Profiling	Clients may carry out risk modelling, where they want to capture and use a range of personal data in order to assess factors affecting those risks.

For any privacy concerns or if you may wish to exercise your right to object to the processing of your personal data, please email dpo@cibi.com.ph.

Dear Guests and Visitors,

Welcome to CIBI!

We respect every individual’s right to privacy as much as we aim to ensure the safety and security of everyone inside CIBI premises, so please take the time to read this Privacy Notice explaining how we process the information we collect from or generate about you once you enter CIBI premises.

WHAT WE COLLECT. We collect basic information about you by asking you to sign our official logbook and requiring you to deposit proof of identity (ID) for verification purposes. Video footage is also being recorded via a CCTV system installed in CIBI entry, and exit points and within the premises.

WHY DO WE COLLECT THEM? While we collect the data primarily as a security measure, they also help us investigate reported violations of CIBI policies and other applicable laws, and generate statistics useful for planning and service improvement purposes.

HOW WE USE, STORE, AND RETAIN THEM. Your data are kept in a place under the custody of at least one administrative personnel who is on duty within CIBI’s working hours. Only authorized CIBI employees and security personnel have access to them. We dispose of the log books two (2) years from the date of collection unless required by law to retain them for a longer period. CCTV footage, on the other hand, is stored for thirty (30) days before being automatically deleted. We do NOT transfer or share your personal data with other persons or organizations unless required by law.

HOW YOU MAY EXERCISE YOUR RIGHTS. You have rights under the law regarding your personal data. Should you wish to exercise them, or if you just happen to have some questions, you may contact our Data Protection Officer: dpo@cibi.com.ph

Thank you and we hope you enjoy your stay!