The Philippine Stock Exchange, Inc. (“PSE”) and its subsidiaries ("PSE", "we", "us" or "our") are committed to respect and protect its stakeholders’ and customers’ personal data in accordance with the Data Privacy Act of 2012 (“DPA”) and its Implementing Rules and Regulations (“IRR”). We will keep secure and confidential all personal data obtained over the course of performing business activities or that PSE may collect unless required to be disclosed by law, court, rules and regulations, or with your authorization.

Personal data refers to all types of personal information or any data about an individual who can be identified from that data, as more specifically defined under the DPA.

This PSE Data Analytics Privacy Policy ("Privacy Policy") explains how and why PSE collects personal data from you when you:

• Use our products or services
• Apply for listing of securities
• Apply for or carry out a regulated role for one of the listed companies (“LC”) or trading participants (“TP”)
• Apply for membership with the Exchange as a TP
• Download documents from us or subscribe for reports or request data
• Attend one of our events, PSE Bell Award, PSE Bull Run, golf tournament, sports events, Certified Securities Specialist Course (“CSSC”), webinars, road shows, fora, or seminars (collectively, “PSE Events”)
• Attend an event hosted at or visit our premises
• Apply for employment, appointment, or training or are employed, elected, or contracted
• Supply products or services
• Subscribe and pay for subscriptions in PSE Equip Data Analytics
• Visit, register to use, use, download, or disclose through our Websites (as applicable, pse.com.ph, www.pseacademy.com.ph, https://easy.pse.com.ph, https://appequip.pse.com.ph/, and https://edge.pse.com.ph), any software application made available by the PSE for use on a computer, tablet, mobile phone or other mobile device (such as PSETRADEX, PSE EASy, PSE Equip, and PSE EDGE), or our social media accounts - The Philippine Stock Exchange, Inc. (Facebook and LinkedIn), Phil. Stock Exchange (PhStockExchange) (Twitter), and PSE channel on YouTube (collectively, “Digital Services”)

How we use, store, disclose, and process your personal data, our legal bases for processing, cookies that we use, how we protect your personal data, your rights under the DPA, and the means by which you can control, to a certain extent, these processes.

Our Websites use cookies to improve and tailor your browsing experience.  Please read part of the Privacy Policy on cookies stated below for more information. If at any time you choose not to accept the terms and conditions of this Privacy Policy or you do not want the PSE to collect, disclose, or process your personal data, you should not open or maintain an account, visit, disclose, register to use, access, or use any of our Websites or Digital Services; submit any application or document; transact with us; supply us with or use our services or products; attend any of our PSE Events;  subscribe to any report or request any data; visit our premises; or seek employment, appointment, or training.

This Privacy Policy complements, and does not limit or replace, the purposes for which you provide the PSE with your personal data which may be expressly given in any form for submission of personal data to PSE or as required under the law or rules and regulations (“Rules”) of the PSE. This Privacy Policy does not apply to access to the PSE’s trading platforms, whether through the internet or by other means. Access to the PSE’s electronic trading platforms is limited to TPs, its authorized personnel, and clients, if applicable, in accordance with the TPs’ agreements with the PSE.

Your use of the Digital Services and any dispute over privacy are subject to this Privacy Policy, Disclaimer and Link Policy available from our homepage, Disclaimer and Terms and Conditions of the PSE Academy, Terms of Use of the PSE Electronic Easy Allocation System  ("PSE EASy"), Terms of Use of PSE Equip, Terms and Conditions of PSE Equip, Disclaimer and Terms of Use of the PSE Electronic Disclosure Generation Technology (“PSE EDGE”), including any applicable limitations on damages and the resolution of disputes. Said Disclaimers, Link Policy, Terms and Conditions, and Terms of Use are incorporated by reference into this Privacy Policy. Your access and use of the PSE accounts in Facebook, LinkedIn, and YouTube are subject to the respective Terms of Service of Facebook, LinkedIn, and YouTube and users thereof who are registered as fans or followers of any of the foregoing PSE accounts will be deemed to consent to the terms and conditions stated herein. Further, you agree to allow our processing and access from the relevant PSE social media account to your publicly available account and profile information such as user names, pictures, birthday, age, gender, employment history, educational background, networks, user ID, and friends’ list publicized by you. In case the PSE acquires personal data, we shall appropriately manage said personal data in accordance with this Privacy Policy and applicable internal security policies of the PSE.

This Privacy Policy applies only in circumstances governed by the Data Privacy Act of 2012 and its IRR. Please read this Privacy Policy carefully and revisit this page from time to time to review changes that may have been made as PSE may, whenever necessary, update this Privacy Policy to ensure that it is consistent with future developments, industry trends and/or any changes in legal or regulatory requirements, and corporate or business changes.

The PSE collects personal data fairly and lawfully. The legal bases for our collection and processing of your personal data will be one of the following:

• To fulfil our contractual obligations to you, for example to allow you to use our products or services;
• To comply with our legal and/or regulatory obligations, for example obtaining your name to enable us to meet our obligations under the Securities Regulation Code (“SRC”);
• To meet our legitimate interests, for example we want to know how you use our Websites or Digital Services in order for us to enhance our products or services or to create new ones; to convey to you the issues or concerns relating to your application or account; to inform you about our products or services that you use or that we offer; to maintain our records; and to review and plan our marketing and business development programs. When we process personal data based on this ground, we implement necessary safeguards which are designed to protect your privacy interests, freedoms, and fundamental rights protected under the 1987 Constitution;
• When processing of your personal data is provided for by existing laws and regulations such as in relation to your employment or for compliance by TPs and LCs with their respective disclosure obligations under the SRC, 2015 Implementing Rules and Regulations (“2015 SRC IRR”), and our Rules; and
• When we are required to obtain your consent by law, for example when we process sensitive personal information, when there is data sharing, or in relation to direct marketing activities. If we ask for your consent to process your personal data, you may withdraw your consent at any time by contacting us using the details at the end of this Privacy Policy. If consent is withdrawn, we will be constrained to terminate processing of your transaction, application, or request unless there is legal basis for further processing of your personal data without need of your consent.

The personal data that the PSE may collect from you depend on the nature and purpose of your interaction, transaction, or application with the PSE such as, but not limited to, the following:

• Your full name, nickname, addresses (email, office, and residential), contact numbers (telephone, office, and mobile phones), title or job title, or designation;
• Photograph, video footage through closed circuit television system, signature, gender, religion, employee number, company name and address, name of school, investor type, and car plate number;
• Payroll information, payroll history, financial benefits, rank, bank account number, loan records, credit card number, tax information number, tax status, and other financial information;
• Citizenship/nationality, information indicated in government-issued ID or company ID, birthday, age, educational and family background, affiliated organizations, health data, biometrics, employment history, work experience, and other curriculum vitae related information;
• Government-issued numbers such as license numbers issued by Securities and Exchange Commission (“SEC”), Social Security System, and Professional Regulation Commission, driver’s license, Roll of Attorneys’ number, and passport information;
• Information on court cases or administrative proceedings;
• Username, password, information about your use of the Websites or Digital Services, including cookies, internet protocol (“IP”) address, and websites visited; and
• Any additional personal data that you may provide through your correspondence(s) with us in connection with your concerns which we shall also consider and treat as personal data.

Your personal data are collected by the PSE either through any of the following instances:

• Directly from you or from your duly-authorized representative, PSE’s subsidiaries, affiliates, partners or representatives, external auditor, or third-party service providers (collectively, “related parties”) collected and disclosed with your consent or authorization, or the PSE may receive your personal data from third-parties such as but not limited to LCs, TPs, transfer agents, underwriters, escrow agents, or counsels to whom you have given consent to transmit your personal data to the PSE;
• Through contracts, agreements, or other legal arrangements you or your authorized person has with the PSE or its related parties; or
• When you browse or use our Websites or Digital Services, we and our third-party service providers use cookies to store information about how you use these Websites and Digital Services in order to enhance your user experience and to improve the quality of service provided to you. Examples of this information may include your IP address, the type of the browser and operating system you are using, domain name, dates and times of your use of our Websites and Digital Services and the route you use to access it. For more information, please refer to the Cookies policy below.

The PSE uses event management website (Eventbrite) to disseminate information about our free seminars which are conducted within or outside our premises and online and allow your registration online for said seminar for your convenience. We also use webinar software tool or application designed for engaging online events (such as but not limited to, GoToWebinar, Zoom, and Microsoft Teams) to enable your participation online in our free webinars which you can view through PSE’s YouTube or Facebook (“FB”) accounts. We may also use other software applications for video conferencing, web conferencing or webinars. Cookies may be used by us, GoToWebinar, Zoom, Microsoft Teams, FB, or by YouTube while participating in our free webinars. If you register online through Eventbrite as participant in our seminar, you are required to provide your name and email address to said entity. Hence, in signing up for our events, you consent to the collection, use, retention, disclosure, and processing of said personal data by the PSE and Eventbrite for the purpose of your attendance in our free seminars. Please check the websites of Eventbrite, GoToWebinar, Zoom, Microsoft Teams, FB, and YouTube for their respective privacy policies. If you do not want your personal data to be collected and processed by the PSE or by any of said service providers, you may opt not to participate in our seminars or webinars.  

The PSE collects, uses, stores, processes, modifies, retains, and discloses your personal data for various lawful and legitimate purposes such as but not limited to:

• Provide you with our products or services or in order for us to improve said products and services;
• Undertake review and evaluation of application/s submitted to the PSE, including the conduct of background checks about you when necessary or required;
• Convey to you matters pertinent to your relationship with or interest in the PSE or to act on your request/s;
• Fulfil contractual or legal obligations under the contract, agreement, or other legal arrangement entered into between you and PSE or with any of its related parties;
• Conduct audit and review of our processes and systems for purposes of managing risks, strategic and action planning, and compliance;
• Protect and enforce contractual and legal rights and obligations of the PSE;
• Enable your attendance or participation in any of our PSE Events, listing ceremonies, listing anniversaries, or any of our social events;
• Verify your identity or to allow your access to the PSE’s premises, including the trading floor, and/or your use of our library and its materials and use of our parking space;
• Comply with applicable laws, rules and regulations, circulars, codes of practice or corporate governance, guidelines, or policies issued by regulatory bodies, or to assist in law enforcement and investigations by relevant authorities, including court proceedings;
• Prevent, detect, and investigate offenses, crimes, or violations of our policies, Rules, or laws, including assessment and management of business risks arising from said offenses or violations;
• Manage the safety and security of the PSE’s premises, information communication technologies, data, systems, services, personnel, traders, and guests;
• Send you information about our products, services, activities, or events that may be relevant to you;
• Allow your registration to use, access, visit, download, or use of our Websites and Digital Services;
• Enable disclosures by LCs and TPs through our Websites and Digital Services for compliance with our Rules, SRC, 2015 SRC IRR, and other issuances of the SEC and PSE;
• Enable you to avail of the local small investors (“LSI”) allocation during an offering;
• Enable your access to comprehensive and reliable information on the Philippine stock market;
• Enable your online payment for your subscription in PSE Equip or Data Analytics;
• Implement and enforce our Rules, memorandum circulars, guidelines, policies, and other issuances; or
• Any other purposes related to any of the foregoing.

We may share your personal data within the PSE and/or related parties in order to provide you with our products or services or to continue your relationship or transaction with us.  Access to your personal data is limited to those employees, agents, and contractors of the PSE who need access to your personal data in order to provide you with our products or services and to carry out legal and regulatory obligations of the PSE. Only personal data pertinent or relevant to the purpose is shared.

The PSE may also share your personal data to third-parties such as payment services provider with your consent for the purposes for which the personal information is collected and for any other reasonable purposes relevant thereto. We use the services of third-party service providers to help us in certain areas such as but not limited to physical security, various maintenance needs, storage and records management, payment system through secure digital platform, conduct of CSSC together with educational institutions, health maintenance coverage, insurance, sports events, background checks, and marketing. Where third-party service providers receive your personal data we will remain responsible for the use of your personal data.  We also take appropriate steps to ensure that such third-parties treat your personal data with the same consideration that we do.

As a Self-Regulatory Organization duly licensed by the SEC and for purposes of implementing our Rules, SRC, 2015 SRC IRR and other issuances of the SEC and the PSE, we disclose to the public through our Websites and Digital Services, particularly the PSE EDGE, personal data collected via disclosures through the PSE EDGE made by LCs and by TPs in compliance with their legal obligations. We also disclose your personal data to the SEC, courts, regulators or foreign counterparts with your consent or when allowed or required under the DPA, SRC, 2015 SRC IRR, our Rules or issuances, and other applicable laws such as in response to law enforcement agencies’ request. With regard to personal data that we collect through the website and mobile application of PSE EASy, we also share with your consent your personal data for the purpose of your LSI allocation during an initial public offering or any public offering with your TP, issuer company, transfer agents, underwriter/s, and counsels of the underwriters and of the issuer company. We also share your personal data collected through your PSE Data Analytics/PSE Equip account to our authorized payment services provider or other online payment solutions to enable your payments for your subscriptions in PSE Data Analytics/PSE Equip.

We may disclose aggregated information that does not identify, or when combined with other information, does not directly and certainly identify any individual.

We may share your personal data within the PSE and/or related parties in order to provide you with our products or services or to continue your relationship or transaction with us.  Access to your personal data is limited to those employees, agents, and contractors of the PSE who need access to your personal data in order to provide you with our products or services and to carry out legal and regulatory obligations of the PSE. Only personal data pertinent or relevant to the purpose is shared.

The PSE may also share your personal data to third-parties such as payment services provider with your consent for the purposes for which the personal information is collected and for any other reasonable purposes relevant thereto. We use the services of third-party service providers to help us in certain areas such as but not limited to physical security, various maintenance needs, storage and records management, payment system through secure digital platform, conduct of CSSC together with educational institutions, health maintenance coverage, insurance, sports events, background checks, and marketing. Where third-party service providers receive your personal data we will remain responsible for the use of your personal data.  We also take appropriate steps to ensure that such third-parties treat your personal data with the same consideration that we do.

As a Self-Regulatory Organization duly licensed by the SEC and for purposes of implementing our Rules, SRC, 2015 SRC IRR and other issuances of the SEC and the PSE, we disclose to the public through our Websites and Digital Services, particularly the PSE EDGE, personal data collected via disclosures through the PSE EDGE made by LCs and by TPs in compliance with their legal obligations. We also disclose your personal data to the SEC, courts, regulators or foreign counterparts with your consent or when allowed or required under the DPA, SRC, 2015 SRC IRR, our Rules or issuances, and other applicable laws such as in response to law enforcement agencies’ request. With regard to personal data that we collect through the website and mobile application of PSE EASy, we also share with your consent your personal data for the purpose of your LSI allocation during an initial public offering or any public offering with your TP, issuer company, transfer agents, underwriter/s, and counsels of the underwriters and of the issuer company. We also share your personal data collected through your PSE Data Analytics/PSE Equip account to our authorized payment services provider or other online payment solutions to enable your payments for your subscriptions in PSE Data Analytics/PSE Equip.

We may disclose aggregated information that does not identify, or when combined with other information, does not directly and certainly identify any individual.

We use cookies on our Websites to provide you with a good user experience, allow us improve our Websites, and to help your browser navigate through our Websites and deliver the full features of our Websites such as by allowing you to log in automatically or remembering settings (e.g. font size and other display preferences) you previously selected. Cookies are small, randomly encoded, text files that we store on your browser or computer or mobile devices. By clicking “I Agree” or by continuing to use our Websites without changing your settings, you agree to our use and storing of cookies in your browser, hardware or device for purposes set forth in this Privacy Policy.

If you do not wish to accept cookies in connection with your use of our Websites, you must stop using our Websites or you should disable or delete the cookies associated with our Websites by changing the settings on your web browser. Please be informed however that if you will disable cookies, certain functions and pages in our Websites will not work in the usual way. To disable cookies, please visit the “Help” or “support” section of your browser to manage your cookies settings, for example:

• Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies;
• Mozilla Firefox: http://support.mozilla.com/en-US/kb/Cookies;
• Google Chrome: http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95647

Types of cookies used

Our Websites use both persistent and session cookies. A persistent cookie enables our Websites to remember you on subsequent visits, resulting in faster and more convenient access to the services or functions offered by our Websites. Persistent cookies stay in your browser until you delete them manually or your browser deletes them on expiry date. Session cookies are temporary cookies that are erased when you close your browser. A session cookie is essential to ensure the correct functioning of our Websites and it is used to manage registration/login and access to the Website’s reserved features. A complete list of the cookies we use is set out in the table at the end of this Privacy Policy.  This list is subject to change from time to time.

We store personal data collected in electronic and paper formats. The security of your personal data is important to us. Thus, in order to protect your personal data from misuse, interference, loss, unauthorized access, modification, and unauthorized disclosure we have adopted appropriate organizational, technical, and security measures such as by  establishing limitations, when applicable, on access to personal data, document storage security policies, security measures on controlled access to our systems and premises, stringent selection of third-party data processors and agents, non-disclosure and privacy protection clauses in agreements, confidentiality agreements and data privacy trainings of our officers and employees, and technology-based security tools, softwares, and measures to protect our Websites, Digital Services, information communication technologies, systems, and data.

We store your personal data physically or electronically with data storage or third-party service providers. For this purpose, we require non-disclosure agreement and make use of contractual arrangements to ensure those providers to take necessary and appropriate measures to protect your personal data and to restrict its access or use.

We will not keep personal data longer than is necessary for the purpose for which they were collected, unless required otherwise by the SRC, 2015 SRC IRR, our Rules, other applicable laws, and rules and regulations. We will take reasonable steps to safely destroy or permanently de-identify personal data if it is no longer needed.

You have rights as a data subject provided under Section 16 of the DPA and Section 34, Rule VIII of the IRR such as:

• Right to be informed of the processing of your personal data;
• Right to object to its processing, except (i) when it is needed pursuant to a subpoena, or (ii) when processing is for obvious purposes, including when it is necessary for the performance of or in relation to a contract or service or when necessary or desirable in the context of an employer-employee relationship, (iii) when the information is being collected and processed as a result of legal obligation;
• Right to suspend, withdraw or order the blocking, removal or destruction of personal data from the filing system upon discovery and substantial proof that the personal data is either: (a) incomplete, out-dated, false, unlawfully obtained; (b) being used for unauthorized purposes; (c) personal data is no longer necessary for the purposes for which they were collected; (d) the data subject withdraws consent or objects to the processing and there is no other legal ground or overriding legitimate interest for the processing; (e) when the personal data concerns private information that is prejudicial to data subject, unless justified by freedom of speech, of expression, or of the press or otherwise authorized; (f) processing is unlawful; or (g) when the personal information controller or personal information processor violated the rights of the data subject;
• Right to be indemnified for any damages sustained due to such inaccurate, incomplete, out-dated, false, unlawfully obtained or unauthorized use of personal data;
• Right to reasonable access to your personal data that we store and process;
• Right to dispute any inaccuracy or error of your personal data in our records and to have it rectified immediately unless the request is vexatious or otherwise unreasonable;
• Right to data portability of your personal data when it is processed by electronic means and in a structured and commonly used format; and
• Right to lodge a complaint before the National Privacy Commission in case of violation of your rights.

If you want to access, update, or correct inaccuracies in your personal data, or have your personal data removed from our databases under any of the grounds provided above, please email us at [email protected] and we will act on your request unless there are practical, contractual or legal reasons why we cannot process your request. We also reserve the right to refuse requests which, in our opinion, occur with unreasonable frequency or otherwise are unreasonable. Moreover, if you are a registered user of any of our Websites and Digital Services, you can also access online your personal account information and make changes by logging into your account. For purposes of your request, kindly use the applicable form provided below:

• Request to Access Personal Data
• Request to Correct or Delete Personal Data
• Request to Cease Processing of Personal Data

Links

The Websites contain links to other sites and when clicking on a link, it is encouraged that you review its privacy policy and decide based on the information provided.

If you have questions or comments about this Privacy Policy, you can contact our Data Protection Officer at [email protected].

You may also contact the National Privacy Commission at:

• Email: [email protected] or [email protected]
• Address: 5th Floor Delegation Building, PICC Complex, Roxas Blvd, Pasay, Metro Manila 1307