Data and Privacy Policy

Introduction

Qwikwire Billing Systems, Inc., doing business under the name AQWIRE ("AQWIRE"), recognizes the importance of protecting the privacy and confidentiality of Personal Data and is committed to processing Personal Data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, applicable issuances of the National Privacy Commission, and other applicable laws and regulations.

This Privacy Policy ("Privacy Policy" or "Policy") sets out the policies and practices governing the collection, use, processing, storage, disclosure, retention, transfer, protection, and disposal of Personal Data obtained by AQWIRE in connection with the access to or use of the Platform and the Services.

This Privacy Policy applies to the AQWIRE payment platform currently accessible at https://pay.aqwire.io (the "Platform"), any website, mobile application, software application, or other digital platform owned, operated, or made available by AQWIRE, and all products, payment solutions, technologies, and related services provided by AQWIRE (collectively, the "Services").

This Privacy Policy applies to all individuals whose Personal Data is processed by AQWIRE in connection with the Platform or the Services, including Payers, prospective Payers, Merchant representatives, authorized users, website visitors, business partners, suppliers, and other individuals who interact with AQWIRE.

About This Privacy Policy

This Privacy Policy forms an integral part of the Terms of Service and governs the processing of Personal Data in connection with the Platform and the Services.

By accessing or using the Platform or the Services, a Payer acknowledges having read and understood this Privacy Policy. Where required by applicable law, AQWIRE shall obtain the consent of the Data Subject prior to processing Personal Data. Where the processing of Personal Data is based on another lawful criterion recognized under applicable law, including the performance of a contract, compliance with a legal obligation, the protection of vital interests, the performance of a public function, or the legitimate interests pursued by AQWIRE or a third party, this Privacy Policy shall serve as notice of such processing.

Any Personal Data collected by AQWIRE through the Platform or the Services shall be processed only for the purposes set out in this Privacy Policy or as otherwise permitted or required by applicable law.

A Payer who becomes aware of any actual or suspected unauthorized access to, loss of, or compromise involving the security credentials associated with the Payer's account shall promptly notify AQWIRE and take all reasonable measures to prevent further unauthorized access or misuse.

General Provisions

The processing of Personal Data is necessary for AQWIRE to provide the Platform and the Services, facilitate payment transactions, verify identities, comply with applicable legal and regulatory requirements, prevent fraud, money laundering, terrorist financing, and other unlawful activities, safeguard the integrity and security of the Platform and the Services, and protect the legitimate interests of AQWIRE, Merchants, Payers, financial institutions, payment partners, and other authorized third parties.

For purposes of this Privacy Policy, "Personal Data" shall have the meaning assigned under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission, and includes Personal Information, Sensitive Personal Information, and any other information from which the identity of a Data Subject is apparent or can be reasonably and directly ascertained.

This Privacy Policy applies to all Personal Data collected, received, generated, recorded, stored, processed, disclosed, retained, transferred, or otherwise handled by AQWIRE in connection with the Platform and the Services, regardless of the manner in which such Personal Data is obtained.

Collection of Personal Data

Subject to applicable laws, AQWIRE, in its capacity as a Personal Information Controller and, where applicable, a Personal Information Processor, may collect and process Personal Data from Data Subjects through the Platform, the Services, communications with AQWIRE, Merchants, payment partners, financial institutions, publicly available sources, and other lawful sources.

The categories of Personal Data that may be collected include, but are not limited to, the following:

Account and Identification Information

• Full name;
• Email address;
• Mobile or telephone number;
• Residential, billing, or mailing address;
• Username, account credentials, or other authentication information;
• Government issued identification information, where required for identity verification, fraud prevention, regulatory compliance, or onboarding;
• Date of birth, nationality, tax identification information, or other identifying information where required by applicable law or regulatory requirements; and
• Any other information voluntarily submitted by the Data Subject or otherwise required for the provision of the Services.

Transaction and Payment Information

• Billing information;
• Payment instructions;
• Payment history;
• Transaction reference numbers;
• Credit card, debit card, bank account, electronic wallet, or other payment instrument information;
• Information relating to refunds, reversals, disputes, or chargebacks; and
• Other financial or transactional information necessary for the provision of the Services.

Technical and Device Information

AQWIRE may automatically collect certain technical information relating to the use of the Platform, including:

• Internet Protocol (IP) address;
• Device identifiers;
• Browser type and version;
• Operating system;
• Device configuration;
• Network information;
• Approximate geographic location derived from technical information;
• Access dates and times;
• Log files;
• Referring URLs;
• Cookies and similar technologies; and
• Other technical information generated through access to or use of the Platform.

2.1 Sources of Personal Data

AQWIRE may collect Personal Data directly from the Data Subject, automatically through the Platform or the Services, or from third parties and other lawful sources, including, but not limited to, the following:

Direct Collection

Personal Data may be collected when a Data Subject:

• registers for or maintains an account with AQWIRE;
• accesses or uses the Platform or the Services;
• initiates, authorizes, or receives a payment transaction;
• requests information regarding AQWIRE, the Platform, or the Services;
• submits inquiries, requests, complaints, disputes, or feedback;
• communicates with AQWIRE through customer support channels, electronic mail, telephone, chat facilities, social media platforms, or other communication channels;
• participates in surveys, promotional activities, events, webinars, or similar initiatives conducted by AQWIRE; or
• voluntarily provides Personal Data for any lawful purpose related to the Platform or the Services.

Automatic Collection

AQWIRE may automatically collect certain Personal Data through the use of cookies, web beacons, software development kits (SDKs), device identifiers, server logs, analytics tools, and similar technologies when the Platform or the Services are accessed or used.

Third Party Sources

Subject to applicable law, AQWIRE may obtain Personal Data from Merchants, financial institutions, payment networks, payment service providers, identity verification providers, business partners, publicly available sources, government agencies, regulatory authorities, service providers, and other third parties authorized or permitted to disclose such Personal Data.

Purposes of Processing

AQWIRE may collect, use, process, store, disclose, transfer, retain, and otherwise process Personal Data for one or more of the following purposes, as permitted or required by applicable law:

• to establish, verify, administer, and maintain accounts;
• to provide, operate, maintain, improve, and support the Platform and the Services;
• to process, authenticate, authorize, facilitate, reconcile, settle, reverse, refund, or otherwise administer payment transactions;
• to communicate with Data Subjects regarding accounts, transactions, inquiries, requests, disputes, complaints, service updates, security notifications, operational announcements, or other matters relating to the Platform or the Services;
• to verify identities, perform customer due diligence, know your customer (KYC), know your business (KYB), identity verification (IDV), sanctions screening, and other onboarding, monitoring, or verification procedures required by applicable law, regulatory requirements, or internal risk management policies;
• to detect, investigate, prevent, mitigate, and respond to fraud, money laundering, terrorist financing, cyber threats, unauthorized transactions, security incidents, prohibited activities, and other unlawful or suspicious conduct;
• to conduct risk assessments, credit assessments, transaction monitoring, fraud monitoring, compliance reviews, investigations, internal audits, and operational controls;
• to comply with applicable laws, regulations, court orders, lawful requests of competent authorities, and the requirements of government agencies, regulators, financial institutions, payment networks, and payment partners;
• to protect the rights, property, security, and legitimate interests of AQWIRE, its Affiliates, Merchants, Payers, financial institutions, payment partners, service providers, and other third parties;
• to enforce the Terms of Service, this Data and Privacy Policy, and other agreements governing the use of the Platform or the Services;
• to develop, test, improve, enhance, secure, and optimize the Platform, the Services, products, technologies, security measures, and user experience;
• to perform analytics, statistical analysis, business intelligence, reporting, forecasting, research, product development, and service improvement using aggregated, anonymized, or de identified data, where appropriate;
• to communicate information regarding products, services, events, promotions, surveys, or other marketing initiatives that may be of interest to the Data Subject, where permitted by applicable law or with the consent of the Data Subject when required; and
• for such other purposes as may be permitted, authorized, or required under applicable laws and regulations.

Disclosure of Personal Data

AQWIRE does not sell Personal Data to third parties. Subject to applicable laws and regulations, AQWIRE may disclose Personal Data only where such disclosure is necessary, appropriate, or authorized for the purposes set out in this Data and Privacy Policy or as otherwise permitted or required by law.

Personal Data may be disclosed to the following recipients, where applicable:

• Affiliates. AQWIRE may disclose Personal Data to its parent company, subsidiaries, Affiliates, joint ventures, and other entities under common ownership or control for legitimate business, administrative, operational, compliance, risk management, security, reporting, and service related purposes, provided that such entities implement appropriate safeguards and process Personal Data in accordance with applicable laws and this Data and Privacy Policy.
• Service Providers and Business Partners. AQWIRE may disclose Personal Data to service providers, contractors, payment partners, financial institutions, payment gateways, payment processors, identity verification providers, fraud prevention providers, cloud service providers, technology providers, customer support providers, marketing service providers, professional advisers, auditors, insurers, collection agencies, and other third parties engaged by AQWIRE to perform services on its behalf or to facilitate the provision of the Platform or the Services. Such recipients shall be authorized to process Personal Data only to the extent necessary to perform the services for which they have been engaged and shall be subject to appropriate contractual, technical, organizational, and security obligations consistent with applicable laws.
• Such recipients shall be authorized to process Personal Data only to the extent necessary to perform the services for which they have been engaged and shall be subject to appropriate contractual, technical, organizational, and security obligations consistent with applicable laws.
• Merchants and Transaction Participants. Where necessary to facilitate, complete, administer, reconcile, investigate, reverse, refund, or otherwise process a transaction, AQWIRE may disclose Personal Data to Merchants, financial institutions, payment networks, payment service providers, settlement partners, and other parties participating in the relevant transaction.
• Legal and Regulatory Authorities. AQWIRE may disclose Personal Data to courts, regulators, supervisory authorities, law enforcement agencies, government agencies, tax authorities, or other competent authorities where such disclosure is required or permitted by applicable laws, regulations, court orders, legal process, regulatory requirements, or lawful requests. AQWIRE may likewise disclose Personal Data where necessary to establish, exercise, or defend legal claims, enforce contractual rights, investigate fraud or other unlawful activities, protect the rights, property, or security of AQWIRE or third parties, or otherwise comply with legal or regulatory obligations.
• AQWIRE may likewise disclose Personal Data where necessary to establish, exercise, or defend legal claims, enforce contractual rights, investigate fraud or other unlawful activities, protect the rights, property, or security of AQWIRE or third parties, or otherwise comply with legal or regulatory obligations.
• Corporate Transactions. Personal Data may be disclosed, transferred, or otherwise made available in connection with any actual or proposed merger, acquisition, consolidation, restructuring, financing, asset sale, business transfer, joint venture, corporate reorganization, or similar transaction, subject to applicable confidentiality obligations and applicable laws.
• Information Provided on Behalf of Third Parties. Any person who provides Personal Data relating to another individual represents and warrants that such disclosure is authorized under applicable law and that the individual concerned has been provided any notice and, where required, any consent necessary to permit AQWIRE to process such Personal Data in accordance with this Data and Privacy Policy.
• Aggregated and De identified Information. Nothing in this Data and Privacy Policy shall restrict AQWIRE from using, processing, disclosing, transferring, or otherwise utilizing aggregated, anonymized, or de identified information that no longer identifies, and cannot reasonably be used to identify, a Data Subject, provided such processing is conducted in accordance with applicable laws.

Inquiries and Prospective Customers

AQWIRE may collect and process Personal Data submitted by individuals who request information regarding the Platform, the Services, or other products and offerings of AQWIRE, including through inquiry forms, electronic mail, telephone, customer support channels, social media platforms, events, webinars, or other communication channels.

Personal Data collected in connection with inquiries shall be processed for the purpose of responding to requests, evaluating business opportunities, providing information regarding the Platform or the Services, conducting follow up communications, establishing or maintaining business relationships, and for other purposes consistent with this Data and Privacy Policy.

Where an inquiry is submitted through a referral partner, intermediary, Merchant, business partner, or other authorized third party, AQWIRE may disclose or receive Personal Data to or from such party to the extent necessary to facilitate the inquiry, evaluate the requested products or services, or otherwise fulfill the purpose for which the Personal Data was provided, subject to applicable laws and appropriate contractual or legal safeguards.

Any Personal Data collected from prospective customers or other individuals who do not subsequently establish a contractual or business relationship with AQWIRE shall be retained only for as long as necessary to fulfill the purposes for which such Personal Data was collected or as otherwise required or permitted under applicable laws and regulations.

Cookies, Analytics, and Similar Technologies

AQWIRE may use cookies, web beacons, software development kits (SDKs), pixels, device identifiers, log files, and other similar technologies (collectively, "Cookies and Similar Technologies") to facilitate the operation of the Platform, enhance the user experience, improve the functionality and performance of the Platform and the Services, maintain security, and support the purposes set out in this Data and Privacy Policy.

Cookies and Similar Technologies may be used for purposes including, but not limited to:

• authenticating users and maintaining active sessions;
• remembering user preferences and settings;
• analyzing the performance and usage of the Platform and the Services;
• detecting, preventing, and investigating fraud, cybersecurity threats, unauthorized access, and other unlawful or suspicious activities;
• improving the functionality, security, reliability, and user experience of the Platform and the Services;
• generating statistical, analytical, and performance reports; and
• delivering communications, advertisements, or content that may be relevant to the interests of Data Subjects, where permitted by applicable law.

AQWIRE may engage third party analytics, advertising, security, cloud, and technology service providers to assist in collecting and analyzing information relating to the use of the Platform and the Services. Such providers shall process Personal Data in accordance with their contractual obligations with AQWIRE and applicable laws.

Data Subjects may configure their browser or device settings to accept, reject, restrict, or delete Cookies and Similar Technologies. Disabling certain Cookies and Similar Technologies may affect the availability, functionality, security, or performance of certain features of the Platform or the Services.

The Platform may utilize analytics tools or similar technologies provided by third party service providers, including Google Analytics or equivalent services, to analyze the use and performance of the Platform and the Services. The use of such technologies shall remain subject to the applicable privacy policies and terms of the relevant third party providers.

Security of Personal Data

AQWIRE implements and maintains appropriate organizational, technical, and administrative safeguards designed to protect Personal Data against accidental or unlawful destruction, alteration, disclosure, loss, misuse, unauthorized access, or any other unauthorized processing, taking into account the nature of the Personal Data, the risks involved in the processing, applicable legal and regulatory requirements, industry standards, and technological developments.

AQWIRE shall implement reasonable and appropriate security measures consistent with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, applicable issuances of the National Privacy Commission, and other applicable laws and regulations. Such measures may include risk assessments, security testing, access controls, encryption, authentication mechanisms, vulnerability management, monitoring, logging, incident response procedures, business continuity measures, personnel training, and other safeguards that AQWIRE considers appropriate to protect Personal Data.

AQWIRE shall periodically review and update its information security policies, procedures, and safeguards to address changes in applicable laws, regulatory requirements, industry standards, operational requirements, emerging technologies, and evolving cybersecurity threats.

While AQWIRE implements reasonable and appropriate safeguards to protect Personal Data, no method of electronic transmission, storage, or processing can be guaranteed to be completely secure. Accordingly, AQWIRE does not warrant that the Platform, the Services, or any transmission or storage of Personal Data will be free from unauthorized access, interruption, interception, alteration, loss, or other security risks beyond AQWIRE's reasonable control.

Retention and Disposal of Personal Data

7.1. Storage of Personal Data

AQWIRE stores Personal Data using information systems, infrastructure, and service providers that implement appropriate physical, organizational, technical, and administrative safeguards consistent with applicable laws, regulatory requirements, and industry standards.

Where AQWIRE engages third party service providers to host, process, store, transmit, or otherwise process Personal Data on its behalf, AQWIRE shall implement appropriate contractual and organizational safeguards designed to ensure that such processing is conducted only for authorized purposes and in accordance with applicable laws and this Data and Privacy Policy.

7.2. Retention of Personal Data

AQWIRE shall retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected and processed, unless a longer retention period is required or permitted under applicable laws, regulations, contractual obligations, lawful orders of competent authorities, or legitimate business purposes.

Without limiting the foregoing, AQWIRE may retain Personal Data where necessary for:

• transaction processing, settlement, reconciliation, chargebacks, reversals, refunds, and dispute resolution;
• fraud prevention, cybersecurity, risk management, investigations, and security monitoring;
• compliance with the Data Privacy Act of 2012, the Anti Money Laundering Act, Bangko Sentral ng Pilipinas regulations, tax laws, accounting requirements, and other applicable laws and regulations;
• audits, legal proceedings, regulatory examinations, enforcement actions, or the establishment, exercise, or defense of legal claims; and
• other legitimate operational, contractual, or regulatory purposes.

Where specific retention periods are prescribed by applicable laws or regulations, AQWIRE shall retain Personal Data for at least the applicable minimum retention period.

7.3. Disposal and Anonymization

Upon expiration of the applicable retention period, and where continued retention is no longer authorized or required by applicable laws or legitimate business purposes, AQWIRE shall securely delete, destroy, anonymize, or otherwise dispose of Personal Data using reasonable methods designed to prevent unauthorized access, reconstruction, recovery, or further processing.

Where appropriate, AQWIRE may retain anonymized, aggregated, statistical, or de identified information that no longer identifies, and cannot reasonably be used to identify, any Data Subject, provided that such information is processed in accordance with applicable laws.

Rights of Data Subjects

Subject to the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and other applicable laws and regulations, Data Subjects may exercise their rights with respect to Personal Data processed by AQWIRE. As AQWIRE operates a payment and billing platform that facilitates transactions between Payers, Merchants, financial institutions, and other payment participants, certain rights relating to Personal Data processed in connection with a Merchant's products or services may be more appropriately exercised directly with the relevant Merchant or other Personal Information Controller. AQWIRE shall process requests within the scope of its role and applicable legal and contractual obligations.

Subject to applicable laws and regulations, Data Subjects have the right to:

• be informed of the processing of their Personal Data;
• access their Personal Data and information relating to its processing;
• object to the processing of their Personal Data where such right is available under applicable law;
• request the correction or rectification of inaccurate, incomplete, outdated, false, or misleading Personal Data;
• request the erasure, blocking, restriction, or suspension of the processing of Personal Data where permitted under applicable law;
• request the portability of Personal Data, where applicable and technically feasible;
• seek damages for violations of their rights under applicable data privacy laws; and
• lodge a complaint with the National Privacy Commission or any other competent authority.

The exercise of the foregoing rights may be limited where the continued processing, disclosure, or retention of Personal Data is required or permitted under applicable laws and regulations, including for payment processing, fraud prevention, anti money laundering and counter terrorism financing compliance, regulatory reporting, dispute resolution, audit, tax and accounting requirements, the establishment, exercise, or defense of legal claims, or the performance of AQWIRE's contractual obligations.

Requests relating to the exercise of these rights may be submitted through the contact details provided in this Data and Privacy Policy. AQWIRE may require reasonable verification of the identity and authority of the requesting party before acting upon any request and may deny or limit requests where permitted or required under applicable laws and regulations.

International Transfer of Personal Data

AQWIRE may transfer, store, access, or otherwise process Personal Data outside the Philippines where necessary to provide the Platform or the Services, perform contractual obligations, engage Affiliates or authorized service providers, comply with applicable laws and regulations, or for other legitimate business purposes.

Where Personal Data is transferred across jurisdictions, AQWIRE shall implement appropriate contractual, organizational, and technical safeguards to ensure that such Personal Data remains protected in accordance with applicable data protection laws and this Data and Privacy Policy.

Communications

AQWIRE may communicate with Data Subjects through electronic mail, telephone, short messaging service (SMS), in app notifications, customer support channels, or other communication channels in connection with the Platform, the Services, transactions, security alerts, account administration, regulatory compliance, customer support, or other legitimate business purposes.

Subject to applicable laws and regulations, AQWIRE may monitor or record telephone calls and other communications with Data Subjects for quality assurance, training, fraud prevention, dispute resolution, security, regulatory compliance, and the establishment, exercise, or defense of legal claims.

Third Party Websites, Applications, and Services

The Platform or the Services may contain links to, integrate with, or otherwise enable access to websites, applications, products, or services operated by third parties that are not owned or controlled by AQWIRE.

Such third parties maintain their own privacy policies, terms of use, and data processing practices, which are independent of this Data and Privacy Policy. Unless expressly stated otherwise, AQWIRE neither controls nor assumes responsibility for the privacy, security, or data processing practices of such third parties. Data Subjects are encouraged to review the applicable privacy policies before providing Personal Data to or using any third party website, application, product, or service.

Amendments to This Data and Privacy Policy

AQWIRE reserves the right to amend, modify, or update this Data and Privacy Policy at any time to reflect changes in applicable laws and regulations, regulatory requirements, business operations, technologies, industry practices, or for other legitimate business purposes.

Any amendments shall become effective upon publication through the Platform or such other means of notice as AQWIRE may determine appropriate, unless a different effectivity date is expressly stated. Continued access to or use of the Platform or the Services after the effective date of the amendments shall constitute acknowledgment of the revised Data and Privacy Policy, to the extent permitted by applicable laws.

Governing Law

This Data and Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of the Philippines, without prejudice to the application of mandatory data protection laws or regulations of other jurisdictions where applicable.