Data Privacy And Protection

We may collect and process personal data from you in the ordinary course of the Company’s business which may include, to the extent necessary to respond to your requests, queries and concerns, basic information such as your name, residence, and contact details, and sensitive personal information such as your age, marital status, tax identification number, government issued identification cards, financial information, tax returns, educational background and work history, among others (collectively, your “Personal Data”).

When you visit our websites or use any of our mobile applications, other information that may also constitute Personal Data, such as your browser type, operating system, IP address, domain name, number of times and dates you visited the website or accessed the mobile application, and the amount of time you spent browsing through the website or mobile application, may be collected via cookies and other tracking technologies, such as transparent GIF files. Aggregate Information, or non-personally identifiable and anonymous data, such as how many times you log onto our websites or mobile applications may also be collected.

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Cookies allow websites to recognize your computer when you return, enabling it to display personalized settings and other user preferences. It also allows websites to respond to you as an individual. The websites and apps can tailor operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being visited. This helps us to analyze data about web page traffic and to improve our website in order to tailor it to your needs. We only use this information for statistical analysis purposes after which, the data is removed from the system.
 

In general, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
 

You will be given the opportunity to accept or reject the use of cookies on our websites in a pop-up box when you first access our website. Once you agree, the file is added and the cookie helps analyze web traffic or lets you know when you visit a particular site. Most web browsers, however, automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. You may choose not to accept the cookies, however, this may restrict the services that you can access at our websites. Declining cookies may also prevent you from taking full advantage of our websites.

When necessary, we request for your Personal Data for us to understand your needs and provide you with a better service, and in particular for the following purposes:

1. Establishing your identity as an investor or a stockholder of record in order to provide you services and accord you the benefits of an investor or a stockholder, which includes managing, administering, approving or facilitating any transaction or action in relation to your shares of stock, the payment of your dividends, and the registration of your shares in the stock and transfer books;
2. Establishing your identity and qualification as job applicant;
3. Complying with the due diligence requirements in fund-raising activities and transactions with lenders, creditors or financial institutions;
4. Complying with the reportorial obligations of the Philippine Stock Exchange (PSE) and the Philippine Dealing and Exchange Corporation (PDEx), and other self-regulating organizations that oversee the company;
5. Complying with the requirements of regulatory agencies and instrumentalities of the government including, but not limited, to the Securities and Exchange Commission (SEC) and Bureau of Internal Revenue (BIR);
6. Collecting and analyzing collective investor or shareholder data or information, and conducting statistical analysis to improve the services to be provided to you including the expeditious response to your concerns and queries, and to ensure that the services to be provided to you as an investor or a stockholder of record are based on accurate and appropriate information; and
7. Complying with and responding to legal processes or lawful orders of any judicial or quasi-judicial bodies.

test

We are committed to ensuring that your Personal Data is kept secure. We have implemented suitable and adequate organizational, physical and technical security measures, policies and procedures intended to reduce the risks of accidental destruction or loss, or the unauthorized disclosure or access to such information which are appropriate and adequate to the nature of the Personal Data we collect.

We may retain your Personal Data only for as long as necessary for legitimate business purposes, to comply with laws, regulations, or lawful court order, or to establish or defend a legal action and will be disposed thereafter according to the disposal policy.

We may share with or disclose your Personal Data to:

1. Any of our affiliate or subsidiary only for the purposes we have collected your Personal Data;
2. Any agent, contractor, or sub-contractor performing services related to stockholders services;
3. Any consultant, adviser, auditor, or service provider we engaged to carry out functions or activities related to our legitimate business activities;
4. Any person to whom we propose to assign or transfer any of its rights and/or duties;
5. Any court of law or administrative agency of the government pursuant to a lawful order issued in relation to a pending case or proceeding before such court or agency;
6. Our lenders or creditors, underwriters, as well as the consultant, adviser or, auditor of the foregoing;
7. Your lawyer, attorney-in-fact, or duly authorized agent or representative, upon presentation of a duly executed special power of attorney;
8. Any regulatory, quasi-judicial or judicial authority, or as otherwise considered necessary or appropriate for our legitimate business purposes.

Any access to Personal Data will be limited to the person who require your Personal Data to perform the functions for which personal information has been collected, and as required or allowed by law. We do not sell, trade, or otherwise transfer your Personal Data to third parties. If shared, we will, at your request, provide you with details of the companies with whom we have shared your Personal Data.

We may amend or update this privacy statement from time to time as may be necessary. We recommend that you check this privacy notice every time we advise you of any change.

You are entitled to request that we:

1. Provide you with a copy of your Personal Data that we hold and inform you of:
   (a) The source of your Personal Data;
   (b) The purposes and methods of processing;
   (c) The data controller’s identity; and
   (d) The entities or categories of entity with whom your Personal Data may be shared;
2. Cease processing your Personal Data, in whole or in part, as you direct us, for any purpose, save to the extent it is lawful to do so without consent under the Data Privacy Act of 2012;
3. Do not transfer your Personal Data to third parties for the purposes of direct marketing or any other purposes you have not consented to;
4. Correct any errors in your Personal Data; and
5. Update your Personal Data as required.

If you have questions, concerns or complaints regarding our compliance with the Data Privacy Act of 2012 or if you wish to exercise your rights to access, rectification, object, portability or deletion in instances allowed under the law, you may contact us through our Data Privacy Officer by way of any of the following channels:

AEV Data Protection Officer
Mailing Address: NAC Tower, 32nd Street, Bonifacio Global City, Taguig City 1634
Email Address: aevdpo@aboitiz.com
Please use the following subject format:
Inquiry on Data Privacy

We will make every reasonable effort to respond to your request within 30 business days subject to legal and other permissible considerations. Should we need more time or information to fulfill your request, we may have an extension of up to 15 business days. During this time, we will communicate with you the reason for the extension. We will also investigate and attempt to resolve complaints and disputes regarding use and disclosure of personal data in accordance with the Data Privacy Act of 2012, its Implementing Rules and Regulations, and other data privacy and protection policies we have put in place. You may bring to the National Privacy Commission any complaint that cannot be resolved with us directly.

As data subjects, you have the right to be informed whether your personal data shall be, are being, or have been processed, including whether the processing was done through an automated decision-making system or profiling activity.

You can find this information in a privacy statement. This document is a demonstration of the data privacy principle of transparency, upholds your right, and every data subject’s right to information. It serves as a statement to data subjects describing how the organization collects, uses, retains, and discloses personal information.

Keep in mind that a privacy notice is not equivalent to consent. While consent may not be required in certain instances when it is not relied on as the basis for processing personal data, a privacy notice is required at all times in order for data subjects to be informed of the processing of their personal data and their rights as data subjects.

You have the right to object to the processing of your personal data if the basis is consent or legitimate interest such as direct marketing, profiling, and automated processing purposes.

In case of any significant change or amendment to the information previously provided to you, you must be notified anew in a reasonable manner. You must also be given an opportunity to object and/or withdraw consent, if consent was previously given for the processing of personal data.

If you expressed your objection, the organization shall stop the processing of personal data and comply with the objection. However, despite your objection, the organization may have other valid grounds to continue processing your personal data. For example, the processing is mandated by law or required in a judicial proceeding. In such instances, the organization must inform the data subject of the lawful basis or compelling reason for the continued processing of their personal data.

You have the right to reasonable access and confirm whether or not data relating to you are being processed, and you may request information about any of the following:

1. The type and category of your personal information processed by the organization;
2. Sources from which your personal information were obtained, if the data was not collected directly from you;
3. Purposes of processing;
4. Manner of processing
5. Information on automated processing system, especially if the decision will be left solely based on the algorithm of such processing activity;
6. Names and addresses of recipients of your personal information;
7. Reasons for the disclosure of your personal information to recipients;
8. Date when your personal information were last accessed and modified;
9. Retention period for your personal information; and
10. The designation, name or identity, and address of the organization’s data protection officer (DPO).

These information are usually found in the privacy notice or consent form that was given to you in observance of the data privacy principle of transparency and to uphold your right to information.

Note that you may only request to have access to your own personal data and other information listed above. You can not request to access information relating to any other individual.

You have the right to dispute the inaccuracy or error in your personal data and have the organization correct the same within a reasonable period of time. You also have the right to have incomplete personal data completed, including the means of providing a supplementary statement for the completion.

Note however that a request may be denied when obviously it is made with no real purpose other than to harass, cause annoyance, or hamper the delivery and performance of services of the organization.

You have the right to request for the suspension, withdrawal, blocking, removal, or destruction of your personal data from the organization’s filing systems.

This right may be exercised upon your discovery with substantial proof of any of the following:

1. 1. The personal data is:
   

   a) incomplete, outdated, false, or unlawfully obtained;
   b) used for an unauthorized purpose;
   c) no longer necessary for the purpose/s for which they were collected; or
   d) concerns private information that is prejudicial to you, subject to certain exceptional circumstance allowed under privacy law;

2. 2. You object to the processing of your personal data and no other laws allow the processing of your personal data;
3. 3. The processing is unlawful; or
4. 4. The organization violated any of your rights as a data subject.

Organizations shall inform, in a reasonable manner, the current and previous recipients or third parties of your request and the erasure of your personal information. Where personal data that is the subject of your request for erasure is publicly available, the organization shall take reasonable and appropriate measures to communicate with other organizations responsible for making your personal information available to the public and request them to erase copies or remove search results or links to your personal data.

When there is a perceived violation of your rights, you may file a complaint with the National Privacy Commission (NPC). Take note that you must communicate your privacy concern with the concerned organization first and try to resolve the issue prior to escalation to NPC.In cases where you file a complaint for violation of your rights, and for any injury suffered as a result of the processing of your personal data, the NPC may award you indemnity for the damages you sustained.

• • You as the data subject may exercise your privacy rights.
  • You may also authorize another person or entity to facilitate the exercise of your rights with specific and documented authorization.
  • The lawful heirs of a data subject may likewise exercise any of his or her rights, at any time after his or her death, or when he or she is

incapacitated or incapable of exercising the same.

Requests shall be resolved within thirty (30) business days upon receipt of the accomplished request form.

An extension of fifteen (15) business days may be given depending on the nature of the request i.e., complex or numerous. You or your authorized representative will be notified in case of extension and the reason for such.

Organizations may deny or limit your requests if:

• • • Information is publicly available. In such case, the organization will point you to the publicly available information;
    • Your request has been previously granted,unless a reasonable period of time has passed from the previous request;
    • Your request will entail disproportionate effort;
    • When your request is made with no real purpose other than to harass, cause annoyance, or hamper the delivery and performance of service;
    • Your request will contrast the need to fulfill the purpose/s for which the data was obtained;
    • Your request will violate the organization’s compliance obligation which requires the processing of your personal data;
    • Your request is contrary to legitimate business purposes of the organization that is consistent with the applicable industry standard for personal

  data retention;

  • Denial or limitation is provided by any existing law, rules, and regulations; and
  • Your request will adversely affect the rights and freedoms of other data subjects.

   

  When your request is denied, you will be clearly and fully informed of the reason for the limitation or denial.

If you want to exercise your rights, you may download the forms applicable to your request:

• Access Request Form
• Erasure Request Form
• Rectification Request Form

You may send the accomplished request form to:

AEV Data Protection Officer
Mailing Address: NAC Tower, 32nd Street, Bonifacio Global City, Taguig City 1634
Email Address: aevdpo@aboitiz.com
Please use the following  subject format:
(NAME OF RIGHT) – FULL NAME OF DATA SUBJECT/REQUESTOR
Example: RIGHT TO ERASURE OR BLOCKING-JUAN DELA CRUZ