Discovery Capital Finance Corp.

DATA PRIVACY POLICY FOR DISCOVERY CAPITAL FINANCE CORP.

Discovery Capital Finance Corp. (DCFC) | Effective Date: June 15, 2026

1. Introduction

Discovery Capital Finance Corp. (“DCFC”, “we”, “us”, “our”) is committed to safeguarding the privacy and security of the personal data entrusted to us. We comply with the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and all relevant issuances of the National Privacy Commission (NPC). This Data Privacy Policy explains how we collect, use, store, share, protect, and dispose of personal data in the course of providing our financial and lending services.

2. Personal Data We Collect

We collect personal, sensitive personal, and financial information necessary for loan processing, account management, and regulatory compliance. These include:

2.1 Personal Information

• Full name
• Home and work address
• Contact details (mobile, email, landline)
• Date of birth, age, nationality, civil status

2.2 Sensitive Personal Information

• Government issued IDs (e.g., UMID, Driver’s License, Passport, TIN, SSS)
• Employment details
• Income and financial capacity
• Bank statements, payslips, COE
• Beneficiary or dependent information

2.3 Financial & Transaction Information

• Loan application details
• Payment history
• Credit standing
• Collateral information (if applicable)

2.4 Information Collected Through Interactions

• Call recordings
• Emails and online forms
• CCTV footage at DCFC offices
• Website and digital platform activity logs

2.5 Information from Third Party Sources

• Credit bureaus
• Partner banks
• Insurance companies
• Government agencies (e.g., SSS, BIR, SEC)

3. Legal Basis for Processing

We process personal data based on the following lawful grounds:

• Contract – processing necessary for loan evaluation, approval, servicing, and account management
• Legal Obligation – compliance with AMLA, KYC, BIR, SEC, and other regulatory requirements
• Legitimate Interest – fraud prevention, credit risk assessment, identity verification
• Consent – for marketing, optional services, and non mandatory data collection

4. Purpose of Processing

We process personal data for the following purposes:

• Loan application evaluation and verification
• Credit scoring and risk assessment
• Insurance underwriting and claims processing
• Customer onboarding and account servicing
• Collections and payment monitoring
• Compliance with AMLA, KYC, and regulatory reporting
• Customer support and dispute resolution
• Marketing of products and services (with consent)
• Business analytics and service improvement

5. Data Sharing and Disclosure

We may share personal data only when necessary, lawful, and consistent with the purposes stated above.

5.1 Sharing With Financial Institutions

We may share personal and sensitive personal information with insurance companies, banks and financing companies, and credit bureaus. Purposes include:

• Credit evaluation and verification
• Loan underwriting
• Insurance underwriting and claims processing
• Risk assessment and fraud prevention
• Regulatory compliance

All such sharing is covered by a Data Sharing Agreement (DSA) or equivalent legal instrument.

5.2 Sharing With Collection Agencies

DCFC may share personal and sensitive personal information with accredited collection agencies for the following purposes:

• Collection of overdue accounts
• Skip tracing and borrower location verification
• Coordination of repayment arrangements
• Enforcement of contractual obligations

Collection agencies are required to operate under a Data Sharing or Outsourcing Agreement, use the data only for authorized collection activities, and maintain confidentiality with adequate security measures.

5.3 Outsourcing and Service Providers

We may engage third party processors for IT services and cloud hosting, customer service, document management, and marketing (with consent). These providers operate under Outsourcing Agreements (OPA) and are required to implement adequate security measures.

5.4 Government Agencies

We may disclose data to AMLC, BIR, SEC, law enforcement, and other agencies as required by law.

5.5 Cross Border Data Transfers

If any service provider or financial partner uses systems located outside the Philippines, DCFC ensures that adequate safeguards are in place, transfers comply with NPC requirements, and data is processed only for authorized purposes.

6. Data Subject Rights

You have the following rights under RA 10173:

• Right to be informed
• Right to access
• Right to rectification
• Right to erasure or blocking
• Right to object
• Right to data portability
• Right to damages
• Right to file a complaint with the NPC

Requests may be sent to the Data Protection Officer.

7. Data Security Measures

DCFC implements administrative, physical, and technical safeguards, including:

Administrative

• Privacy policies and procedures
• Employee training and NDAs
• Access control and authorization levels

Physical

• Secure office premises
• CCTV monitoring
• Controlled access to storage areas

Technical

• Encryption of data in transit and at rest
• Firewalls and intrusion detection
• Multi factor authentication
• Regular backups
• Audit logs and monitoring

8. Data Breach Management

DCFC maintains a breach response protocol that includes immediate containment and assessment, internal escalation to the DPO, notification to the NPC within 72 hours when required, notification to affected individuals when there is a risk of harm, and documentation of all breach incidents.

9. Policy Updates

DCFC may update this policy to reflect changes in regulations or business processes. Updates will be posted on our website or communicated through appropriate channels.

10. Contact Information

Data Protection Officer
Discovery Capital Finance Corp.
Unit 2103, One Global Place, 26th St., Corner 5th Ave., Taguig City, 1630
Email: dpo@discoverycapital.com.ph