Privacy Statement

The Bangko Sentral ng Pilipinas (BSP) is committed to fully protect your personal data privacy in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA).

In all instances, we assure you that processing your personal data will strictly follow the provisions of DPA, especially the general data privacy principles of Transparency, Legitimate Purpose, and Proportionality.

The BSP's mandate under Republic Act No. 11211, otherwise known as “The New Central Bank Act," and other special laws, involves a number of processes that may include personal information related to its personnel, business contacts, customers, or staff of financial and non-financial institutions it supervises and regulates, as well as the general public in the course of surveys and similar activities intended for research and policymaking. These processes are subjected to independent audit to improve the quality of information and delivery of service.

BSP Mobile Application Privacy Notice

This Privacy Notice is for the BSP Mobile application (app) which contains functionalities that enable the BSP to collect and process users' personal information. The BSP Mobile app includes the BSP Online Buddy (BOB), a consumer chatbot that receives complaints against banks and other BSP-supervised financial institutions (BSFIs).

Personal Data Collected and Manner of Collection

We collect the following personal data when you use the BOB chatbot through the BSP Mobile app:

• Full name
• Email address

Basis, Use, and Purpose for Processing of Personal Data

Your personal data will be used for the following purposes:

• For documentation and processing of inquiries and requests within the BSP, enabling the BSP to properly address and forward them to its internal units for appropriate action;
• To receive feedback for services provided, either through the BOB chatbot or other communication tools;
• To provide updates and advisories through push notifications and widgets; and
• To provide appropriate action that a data subject may require concerning their data privacy rights.

 
Moreover, we may collect other personal data that are necessary to provide support and data subject assistance.

Methods utilized for automated access

The BSP uses Google Analytics for Firebase, a third-party service, to analyze our app traffic data, determine our app's engagement, and improve our app's services and features.

The following web traffic data are processed for this purpose:

• Your IP address
• The screens accessed on our app
• The date and time you used the app
• Geolocation
• Your device's operating system
• Your device's make and model

We automatically collect certain information when you visit, use, or navigate the app's services. This information does not reveal your specific identity (e.g., name or contact information) but is primarily needed to maintain the security and operation of our services, and for our internal analytics and reporting purposes.

By agreeing to continue using the BSP Mobile app, you consent to provide the following data to enjoy the app's features, facilitate the delivery of BSP services, troubleshoot issues/bugs, and to facilitate internal analytics and reporting purposes:

• Geolocation Information - We may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services. If you wish to change our access or permissions, you may do so in your device's setting
• Mobile Device Access - We may request access or permission to certain features from your mobile device, including your mobile device's camera, and other features. If you wish to change our access or permissions, you may do so in your device's settings.
• Push Notifications - We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.
  

Disclosure of Personal Data

Personal data processed by the BSP are not shared with any other party unless such disclosure is allowed under Section 12 or 13 of the DPA.

Your personal data will be processed only by authorized staff on a need-to-know basis, depending on the specific purposes for which your personal data have been collected.

When using the location services, however, we may need to use your device information and share it with Google Maps Platform API¹ to efficiently locate your position and provide directions. Google Maps uses GPS, Wi-Fi, and cell towers to estimate your location. GPS is accurate to about 20 meters, while Wi-Fi and cell towers help improve accuracy when GPS signals are weak, such as in indoor locations.

Risks Involved

The BSP ensures that adequate physical, technical, and organizational security measures are in place to protect the confidentiality, integrity, and availability of personal information. However, this does not guarantee absolute protection against certain risks involving the processing of personal data, such as when systems are exposed to targeted cyberattacks, malware, ransomware, and computer viruses, or when manual records are accessed without authority.

However, adequate policies are in place to ensure appropriate security incident management in line with existing BSP policies, circulars, and other issuances.

Data Protection and Security Measures

We use appropriate measures to keep your personal data confidential and secure. Please note, however, that these protections do not apply to information you choose to share in public areas such as third-party social networks.

We store your personal data in operating environments that use reasonable security measures to prevent unauthorized access. Among these measures are the following:

• Information security policies on access control in both digital and physical infrastructures to prevent unauthorized access;
• Cybersecurity policy encompassing acceptable use and data classification;
• End-to-end encryption;
• Business continuity measures against natural disasters, power disturbances, external access, and similar threats; and
• Technical measures to protect our Information and Communication Technology (ICT) resources against accidental, unlawful, or unauthorized usage, interference, or access.

¹ Subject to Google Maps/Google Earth Additional Terms of Service at https://maps.google.com/help/terms_maps.html and the Google Privacy Policy at https://www.google.com/policies/privacy/

² https://privacy.gov.ph/right-to-damages/