Privacy Notice

1. YOUR PRIVACY AT A GLANCE

Who we are:

This system operates under a Joint Controllership agreement between Ayala Land, Inc. and its partner corporate subsidiaries (including Accendo Commercial Corp., ALI Capital Corp., Alveo Land Corp., Amicassa Process Solutions, Inc., Avida Land Corp., Ayala Land International Sales, Inc., Ayala Land Premier, Inc., Ayala Property Management Corporation, AyalaLand Business Solutions, Inc., AyalaLand Estates, Inc., AyalaLand Hotels and Resorts Corp., AyalaLand Logistics Holdings Corp., AyalaLand Malls, Inc., AyalaLand Offices, Inc., Cagayan de Oro Gateway Corp., Darong Agricultural & Development Corp., DirectPower Services, Inc., Laguna Technopark Inc., Lio Resort Ventures, Inc., Makati Development Corporation, MDBI Construction Corp., MDC Conqrete, Inc., Southcrest Hotel Ventures Inc., Sentera Hotel Ventures Inc., Cebu Insular Hotel Company Inc., Bonifacio Hotel Ventures Inc., Capitol Central Hotel Ventures Inc., Central Bloc Hotel Ventures Inc., Northgate Hotel Ventures Inc., Econorth Resort Ventures Inc., Bay Area Hotel Ventures Inc., Ecosouth Hotel Ventures Inc., Makati North Hotel Ventures Inc., North Triangle Hotel Ventures Inc., Station Square East Commercial Corp., Ten Knots Development Corporation, and Ten Knots Philippines, Inc.).

Our Arrangement:

Ayala Land, Inc. acts as the Lead Controller directing the administrative guidelines and strategic privacy governance of the platform. The remaining listed subsidiary corporate entities act as Partner Entities who directly manage individual employee relationships, underlying labor contracts, corporate HR files, and payroll-synchronized service delivery.

Technical infrastructure, platform operations, and physical data hosting are outsourced entirely to our contracted Personal Information Processor (PIP), FFMIRAVITE, Inc. (doing business under the Name and Style of Miravite Consulting Group), under strict Data Processing Agreements.

What we do:

We provide the Miravite Online Retirement Platform specifically to manage and administer the retirement fund assets of Ayala Land, Inc. and its designated subsidiary employees.

Why we collect data:

We process your information based on your explicit Consent, Contractual Necessity (for the execution and deployment of employment benefits), and Legal Obligation (under Article 306 of the Labor Code of the Philippines and the Data Privacy Act of 2012).

Our "Big Rule":

We do not sell your personal data. We only share it with specialized third-party infrastructure providers—primarily our designated PIP, MIRAVITE Consulting Group—strictly as necessary to provide the administrative services of the Miravite Online Retirement Platform.

2. WHEN & HOW WE COLLECT DATA

We collect your information through structured channels to make your retirement tracking seamless:

• Hive Core System Extraction (Electronic Channel): Triggered automatically through electronic synchronizations, we collect your Full Name, Employee ID, Hiring Entity, Group/Division, Company Email Address, Hire Date, and Birthdate primarily to securely authenticate your credentials, verify your hiring context, and determine your exact retirement vesting metrics.
• Voluntary Contribution Panel (Electronic Channel): Triggered actively when you log in and voluntarily nominate a specific savings percentage, we collect your designated Retirement Fund Contribution metrics to calculate monthly salary deductions and update your aggregated historical balances.
• System-Generated Data (Electronic Channel): Triggered automatically when you navigate or log into the platform, technical audit logs, device footprints, and activity timestamps are gathered within Miravite's infrastructure to safeguard system security and maintain diagnostic platform compliance.

3. HOW WE USE YOUR INFORMATION

We process your personal data only when the law allows us to. The table below outlines our primary processing activities:

We do not perform "Automated Decision-Making" that has legal effects or significantly affects you without a human being involved in the process. Automated mechanics are strictly restricted to basic computational tracking of savings and tenure.

4. WHERE YOUR DATA LIVES

To provide a secure and robust localized environment, your personal data is isolated and guarded as follows:

• Host Locations: Our primary data infrastructure and secure digital vaults are fully hosted on-premise at the dedicated data servers utilized by MIRAVITE Consulting Group in Bonifacio Global City (BGC), Taguig City, Philippines. Secondary system backups are continuously mirrored to separate infrastructure in Taytay, Rizal, Philippines.
• Safety Standards: No international cross-border transfers are executed out of these local boundaries. These data environments are strictly ring-fenced under explicit Data Processing Agreements (DPAs) to guarantee technical security matching or exceeding National Privacy Commission standards.
• Sub-processors: Any technical partners or maintenance tools operating within these regions are thoroughly vetted to ensure they adhere to high-standard technical, physical, and organizational security policies.

5. HOW WE KEEP YOUR DATA SAFE

We implement a "Defense in Depth"—multiple layers of security to keep your personal data private:

• Technical Controls: We apply Transport Layer Security (TLS) encryption to encrypt data traveling over the network, and deploy active network firewalls.
• Organizational Rules: System access permissions are strictly restricted to authorized HR administrators, benefits managers, and validated IT engineers via Role-Based Access Control (RBAC) environments featuring continuous logging. All system handlers and processor personnel are bound by non-disclosure statements and receive ongoing privacy training.
• Physical & Infrastructure Security: Server infrastructure in BGC and Taytay utilized by Miravite is protected by physical security boundaries, including biometrics, 24/7 continuous CCTV monitoring, environmental controls, and strict physical access logs.

6. DO WE USE COOKIES?

Yes. We use small digital tracking assets called "cookies" and similar technical identifiers to maintain operational platform performance:

• Strictly Necessary: Absolute requirements to run the platform, allowing you to authenticate your employee identity, manage secure sessions, and support identity verification mechanisms.
• Security & Performance: Session cookies are configured with protective security controls and session management mechanisms, including automatic session expiration after a period of inactivity, to help protect account access.

Note: You retain the option to disable cookies within your individual web browser, but certain structural options or automated features on the platform may cease to operate correctly.

7. WHEN DO WE DELETE YOUR DATA?

We believe in Data Minimization—we don't keep what we don't need.

• Our Timeline: Once your primary employment relationship ends, we transition your data to inactive records. Under Article 306 of the Labor Code of the Philippines, claims may be asserted up to three years from separation; therefore, we securely hold your records for exactly three (3) years from your separation date.
• The Final Step: Upon expiration of the three-year statutory clock, or upon the termination of the corporate service agreement, all relevant data assets undergo permanent deletion or scrubbing from Miravite's online platform and physical servers upon explicit written request from Ayala Land, Inc. A formal verification certificate will be executed upon completion of the scrub.
• A Few Exceptions: Records may be maintained for longer windows only if actively tied to ongoing tax clearance tracking, anti-money laundering compliance, or outstanding administrative or judicial legal claims.

8. YOUR DATA PRIVACY RIGHTS

You are in the driver's seat. Under the Philippine Data Privacy Act of 2012, you have the right to:

• Be Informed: Understand how your data is being collected and used. This Notice serves that purpose.
• Access & Portability: Request a copy of the personal data we hold about you in a common, machine-readable format. We may charge a reasonable administrative fee.
• Rectify: Correct any inaccurate information or outdated data. For immediate changes to your professional record or personal details, please coordinate directly with your assigned HR representative to correct your data at the source.
• Object: Stop the processing your data for direct marketing or Automated Decision-Making activities, unless required by law or to fulfill our contract with you.
• Erasure: Request that we delete your personal data subject to our legal retention obligations.
• File a Complaint: Raise a complaint about a violation of your data privacy rights. Please tell us first through alidataprivacy@ayalaland.com.ph, so we have a chance to address your concerns. If we fail in this, you can address any complaint to the National Privacy Commission (NPC).
• Damages: Seek indemnity for verifiable damages sustained due to a violation of your rights.

9. YOUR ROLE IN STAYING SECURE

Privacy is a partnership. To keep your account safe, we need you to:

• Be Accurate: Provide us with true and updated personal data, and let us know if your contact details change to ensure you continue receiving critical alerts.
• Protect Your Credentials: Keep your username and password confidential.
• Report Suspicious Activity: Tell us immediately at security@ayalaland.com.ph if you think your account has been compromised.

10. CONTACT OUR PRIVACY TEAM

If you have any questions, concerns, or requests regarding your personal data, or if you wish to exercise your rights under the Philippine Data Privacy Act, please reach out to our Data Protection Officer at:

• Lead DPO Email: alidataprivacy@ayalaland.com.ph
• Primary Corporate Office: 30F Tower One and Exchange Plaza, Ayala Triangle Gardens, Ayala Avenue, Makati City
• Internal Channels: Contact your designated subsidiary HR Representative.