1.2 The Personal Information that n90 may collect from you, depending on the nature of your interaction with us, includes:

1. Identification and contact details, including full name, date and place of birth, civil status, sex, nationality, present and permanent address, telephone numbers, email address, and specimen signature;
2. Sensitive Personal Information consisting of government-issued identifiers, as further described in Section 1.3;
3. Know-Your-Customer and customer due diligence documentation, including photographs, selfies, copies of government-issued identification, proof of address, source of funds, and beneficial ownership information;
4. Financial and credit information, including employment and employer details, occupation, income, bank account details for disbursement and payment, loan history, outstanding obligations, information on co-makers, guarantors, and references, collateral, and credit scoring data;
5. Transaction information, including loan application data, loan terms, repayment schedules, payment history, delinquency status, and related communications;
6. website and online identifiers, including IP address, browser type and language, operating system, cookies, session tokens, referring URLs, and website server logs, as further described in Section 5; and
7. any other information you provide to us, or that we lawfully collect from third-party sources, in the course of your interactions with n90.

‍
The specific categories of Personal Information collected for particular purposes (such as loan applications, vendor onboarding, employment, or partnership) are further described in Section 3 below.

3.1 Generally, n90 collects, uses, processes and discloses your Personal Information for the following specific purposes on basis of the consent given (where applicable) for:

1. transacting with you and providing our loan services and products;
2. responding to your queries, feedback and requests;
3. managing the administrative operations of n90 and complying with internal policies, reporting requirements and procedures;
4. managing the safety and security of our premises and systems;
5. facilitating business asset transactions (which may extend to any mergers, acquisitions or asset sales) involving any of our entities;
6. conducting communication activities, including posting on our websites or social media platforms or inclusion into videos and marketing collaterals;
7. requesting feedback or participation in surveys, as well as conducting market research and/or analysis for statistical, profiling or other purposes for us to design our services and products, understand customer behaviour, preferences and market trends, and to review, develop and improve the quality of our services and products;
8. monitoring or recording phone calls for quality assurance, employee training and performance evaluation and identity verification purposes;
9. matching any Personal Information held which relates to you for any of the purposes listed herein;
10. hosting, storing or backing-up your Personal Information, which may be on third party servers or data clouds;
11. legal purposes in connection with any claims, actions or proceedings (including but not limited to drafting and reviewing documents, transaction documentation, obtaining legal advice, and facilitating dispute resolution), and/or protecting and enforcing our contractual and legal rights and obligations;
12. meeting or complying with any applicable rules, laws, regulations, codes of practice or guidelines issued by any legal, statutory or regulatory bodies which are binding on n90 (including but not limited to responding to regulatory complaints, disclosing to regulatory bodies, disclosures required in the public interest or emergencies and conducting audit checks, due diligence and investigations which may be carried out by statutory authorities); and/or
13. purposes which are reasonably related to the aforesaid.

3.2 In addition, N90 collects, uses and discloses your Personal Information for the following purposes:

1. if you are a borrower of N90:
   1. evaluating your financial capacity and ability to repay the loan based on income, expenses, and assets.
      
   2. determining your creditworthiness and  risk profile.
   3. verifying your identity
   4. streamlining loan approvals
   5. detect and mitigate fraudulent activities
   6. complying with legal and regulatory requirements
   7. monitoring loan repayment behavior to ensure compliance with loan terms.
   8. enhancing customer experience
2. if you are a vendor of N90:
   1. assessing your suitability as vendor (i.e. external service provider, consultant, contractor etc.);
   2. managing requests for proposals or quotations, processing orders or managing supply of goods and/or services;
   3. processing and payment of invoices; and/or
   4. purposes which are reasonably related to the aforesaid.
3. if you submit an application to us as a candidate for an employment or other post:
   1. evaluation and assessment of your suitability;
   2. conducting interviews;
   3. processing your application (including but not limited to pre-recruitment checks involving your qualifications and facilitating interviews);
   4. providing or obtaining references and for background screening;
   5. assessing your suitability for the position applied for;
   6. onboarding successful candidates and facilitating human resource planning and management; and/or
   7. purposes which are reasonably related to the aforesaid.
4. if you are an employee of N90:
   1. staff orientation and entry processing;
   2. determining, processing and reviewing salaries, bonuses and other benefits;
   3. assessing your performance;
   4. considering and processing applications for continuing skills development and training, including organizing training and staff development programmes or events;
   5. administrative and support processes relating to your employment, including its management and termination, staff benefits, including travel, manpower, business continuity and logistics management or support, processing claims, training, learning and talent development, and planning or organizing corporate events;
   6. business continuity purposes;
   7. conducting analytics and research for human resource planning and management and developing, optimizing and improving work-related practices and environment;
   8. conducting internal investigations and proceedings, whistleblowing, internal monitoring and audits; and/or
   9. purposes which are reasonably related to the aforesaid.
5. if you are a partner, investor, or shareholder of n90, or the authorized representative of such a partner, investor, or shareholder:
   
   1. partner and investor onboarding and Know-Your-Customer procedures, including beneficial ownership and sanctions screening;
   2. negotiating, executing, and administering partnership, investment, subscription, shareholders', and similar agreements;
   3. processing capital contributions, share issuance, dividends, distributions, and settlement;
   4. maintaining the stock and transfer book and other statutory registers under the Revised Corporation Code;
   5. managing corporate governance matters, including notices of meetings, proxies, and voting records;
   6. complying with reporting obligations to the Securities and Exchange Commission, Bureau of Internal Revenue, AMLC, and other regulators; and/or
   7. purposes which are reasonably related to the aforesaid.
6. If you visit n90's offices or premises (whether as a client, counterparty, vendor representative, applicant, courier, auditor, regulator, contractor, or other guest):
   
   1. visitor management, including registration, identification, and tracking of your entry to and exit from n90's premises;
   2. premises security and safety, including the protection of n90's personnel, visitors, assets, and information;
   3. emergency response, evacuation, and headcount;
   4. incident response, investigation, and reconstruction; and/or
   5. compliance with lawful requests from regulators, law enforcement, or in legal proceedings.

A short-form Visitor Privacy Notice is displayed at the reception area of n90's offices.

‍

3.3 n90 may send you marketing communications about its loan products, services, promotions, and related offers through email, SMS, voice call, or other electronic channels. n90 sends marketing communications only:

1. where you have given specific, informed, and freely given consent to receive marketing communications from n90;
2. where n90 has an existing customer relationship with you that permits such communications under applicable law, including on the basis of legitimate interest; or
3. where otherwise permitted or required by law.

You may withdraw your consent or opt out of receiving marketing communications at any time and without cost, by clicking the unsubscribe link contained in any marketing email, replying with the appropriate keyword to a marketing SMS, or emailing the DPO at hello@n90.asia.

‍

3.4 As a lending company, n90 is a mandatory submitting entity under Republic Act No. 9510 (the Credit Information System Act). n90 shall regularly submit your basic credit data to the Credit Information Corporation (the "CIC") in the form, manner, and within the timelines prescribed by the CIC and its implementing rules.

Basic credit data submitted to the CIC may include your identification information, loan account details, repayment history, outstanding balances, and credit performance. The CIC may share this credit data with its accredited special accessing entities (such as other lenders, credit bureaus, and financial institutions), in accordance with RA 9510 and the rules of the CIC.

You have the right to dispute any credit data submitted to the CIC that you believe is inaccurate or erroneous, by filing a dispute directly with n90 or with the CIC. n90 shall investigate the dispute, rectify any confirmed errors, and submit corrected data to the CIC within the period prescribed by the CIC.

‍

3.5 As a lending company, n90 is a "covered person" under Republic Act No. 9160, as amended (the Anti-Money Laundering Act of 2001), and is subject to its implementing rules and the regulations of the Anti-Money Laundering Council (the "AMLC"). In compliance with these obligations, n90 collects, uses, and discloses your Personal Information for the following purposes:

1. to perform Know-Your-Customer (KYC) procedures, customer due diligence, and enhanced due diligence, including the collection and verification of identification documents, source of funds, and beneficial ownership information;
2. to screen you and your transactions against domestic and international sanctions lists, including the United Nations Consolidated List and any designations issued by the AMLC, and to identify and assess politically exposed persons;
3. to file covered transaction reports and suspicious transaction reports with the AMLC, in the form and within the period prescribed by law;
4. to maintain records of customer identification and transactions for the period required by RA 9160 and its implementing rules; and
5. to comply with any other obligation arising under RA 9160 and related anti-money laundering and counter-terrorist financing laws and regulations.

The existence, filing, and contents of any covered transaction report or suspicious transaction report shall be treated as strictly confidential under RA 9160, and n90 shall not disclose the filing or contents of any such report, nor warn or "tip off" the subject of any such report.

‍

3.6 n90 treats client information as strictly confidential, subject only to the disclosures permitted under the DPA, RA 11765, and related laws. n90 observes the consumer protection standards of disclosure and transparency, fair treatment, protection of client information, and effective recourse in its lending operations. You may raise any concern regarding the processing of your Personal Information or your treatment as a financial consumer through the channels described in Section 9 of this Policy.

4.1 n90 will take commercially reasonable steps to protect your Personal Information against unauthorized disclosure. Subject to the provisions of any applicable law, your Personal Information may be disclosed, for the purposes listed above (where applicable), to the following entities or parties, whether they are located in the Philippines or overseas:

1. n90’s related corporations and employee(s); to address your questions and requests in relation to your interactions with us, to maintain and operate our systems and/or services;
2. agents, contractors or third-party service providers who provide services to n90, such as cloud hosting, information technology, electronic document execution platforms (such as DocuSign, used for the signing of loan agreements and related instruments), bank statement analysis and credit assessment tools, loan management systems, identity verification, fraud detection, sanctions and anti-money laundering screening, courier services, telecommunications, payment, printing, billing, payroll, processing, collection agencies, technical services, security, or other services to n90;
3. any business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale) involving any of our entities;
4. external banks and their respective service providers;
5. insurance companies, guarantors, sureties, co-makers, and other risk-sharing counterparties, where the disclosure is necessary in connection with your loan or the underlying credit relationship
6. industry associations, finance-sector bodies, and similar organizations of which n90 is a member, where the sharing is for credit reference, fraud prevention, and risk management purposes, subject to a Data Sharing Agreement;
7. companies which provide corporate secretarial services;
8. our professional advisers such as consultants, auditors and lawyers;
9. relevant government ministries, regulators, statutory boards or authorities or law enforcement agencies to comply with any laws, rules, guidelines and regulations or schemes imposed by any governmental authority; and/or
10. the Credit Information Corporation, accredited credit bureaus, and accredited special accessing entities;
11. the Anti-Money Laundering Council; and
12. any other party to whom you authorize us to disclose your Personal Information to.

4.2 Please note that the disclosures referred above may be subject to additional legal requirements under applicable law, if we do disclose your Personal Information, we will only do so to the extent necessary, proportionate and legally permitted.

6.1 You have the following rights as a data subject under the DPA, which may be exercised by contacting n90 in writing:

1. Right to Be Informed: To know how your data is collected, used, and shared.
2. Right to Access: To request a copy of your personal data.
3. Right to Correction: To correct inaccurate or outdated data.
4. Right to Object: To refuse the processing of your data for certain purposes.
5. Right to Erasure: To request deletion of your data, subject to legal or contractual obligations.
6. Right to Data Portability: To request your data in a commonly used electronic format.
7. Right to File a Complaint: To lodge a complaint with the National Privacy Commission.
8. Right to Damages: To be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.

6.2 Without prejudice to n90's internal complaint-handling procedure described in Section 9 of this Policy, you may also file a complaint directly with the National Privacy Commission.

7.1 n90 will take reasonable efforts to protect Personal Information in our possession or our control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks.

‍
We implement appropriate organizational, technical, and physical measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These measures include but are not limited to:

• Encryption: Ensuring that sensitive data is encrypted during transmission and storage to prevent unauthorized access.
• Access Controls: Restricting access to personal data to authorized personnel only, based on the principle of least privilege.
• Regular Security Audits: Conducting regular audits and assessments to identify and address vulnerabilities in our systems.
• Secure Software Development: Employing secure coding practices to minimize risks associated with software vulnerabilities.
• Incident Response Plan: Maintaining a comprehensive incident response plan to address potential data breaches promptly and effectively.
• Data Minimization: Collecting only the personal data necessary for the purposes outlined in this policy and retaining it only for as long as needed.
• Physical Security: Securing physical locations where personal data is stored to prevent unauthorized access or theft.

However, we cannot completely guarantee the security of any Personal Information we may have collected from or about you, or that for example no harmful code will enter our website (for example viruses, bugs, trojan horses, spyware or adware). You should be aware of the various associated risks with using websites.

‍

7.2 While we strive to protect your Personal Data, we cannot ensure the security of the information you transmit to us via the Internet or otherwise and we urge you to take every precaution to protect your Personal Data when you are on the internet or use such platforms.
‍
7.3 If applicable, you undertake to keep your username and password secure and confidential and shall not disclose or permit it to be disclosed to any unauthorized person, and to inform us as soon as reasonably practicable if you know or suspect that someone else knows your username and password or believe the confidentiality of your username and password has been lost, stolen or compromised in any way or that actual or possible unauthorized transactions have taken place. We are not liable for any damages resulting from any security breaches, on unauthorized and/or fraudulent use of your username and password.

‍

7.4 In the event of a personal data breach that is likely to give rise to a real risk of serious harm to affected data subjects, n90 shall notify the National Privacy Commission and the affected data subjects within seventy-two (72) hours from knowledge of, or reasonable belief that, the breach has occurred, in accordance with the DPA and its implementing rules. n90 has constituted a Data Breach Response Team, led by the DPO, responsible for the immediate investigation, containment, and response to personal data breaches and security incidents.

9.1 If you have any questions, feedback, requests, or complaints relating to your Personal Information or this Data Privacy Policy, you may contact n90's Data Protection Officer:

You may contact the Data Protection Officer if you wish to:

1. raise any question or concern relating to your Personal Information or this Data Privacy Policy;
2. exercise your rights under Section 6 of this Policy;
3. withdraw your consent to any use of your Personal Information as set out in this Data Privacy Policy; or
4. request access to, or correction of, your Personal Information records.

9.2 Please note that if your Personal Information has been provided to us by a third party (e.g. a referrer, or your company), you should contact that organization or individual to make such queries, complaints, and access and correction requests to n90 on your behalf.

‍

9.3 If you withdraw your consent to any or all use of your Personal Information, depending on the nature of your request, n90 may not be in a position to continue to provide its products and services to you, administer any contractual relationship in place, which in turn may also result in the termination of any agreements with n90, and your being in breach of your contractual obligations or undertakings. n90’s legal rights and remedies in such an event are expressly reserved.