Privacy Notice

We at CIMB Bank Philippines Inc. (CIMB Bank PH) understand the importance and value of your personal information and right to data privacy. We are committed to protecting the confidentiality, integrity, and security of the personal data we collect and process. 

This Privacy Notice explains how we collect, use, store, disclose, and protect your personal data, in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and relevant issuances of the National Privacy Commission (NPC). 

This Privacy Notice applies to CIMB Bank PH customers and prospective customers, visitors or those who make inquiries at any of our authorized channels, and such other persons involved in any application or transaction with CIMB Bank PH, regardless of its status. 

1. YOUR DATA PRIVACY RIGHTS

As a data subject, you have the following rights:

• The right to be informed that your personal data will be, are being, or have been processed.

• The right to reasonable access to your personal data.

• The right to object to the processing of your personal data, including for direct marketing, automated processing, or profiling.

• The right to correct your personal data if it is inaccurate, incomplete, misleading and/or not up to date.

• The right to erasure or blocking of your personal data, subject to applicable laws. You can also request to suspend or withdraw your order to erase or block your personal data from our system.

• The right to damages for any violation of your data privacy rights. 

• The right to data portability, i.e., you may obtain a copy of your personal data or have your personal data sent to another party in an electronic or structured format for further use.

• The right to file a complaint before the NPC. 

Kindly note that the rights above may be subject to other relevant laws, rules and regulations that apply specifically to banks and their customers, such as but not limited to Bank Secrecy Law (Republic Act No. 1405, as amended), the Anti-Money Laundering Act (Republic Act No. 9160, as amended), and the Anti-Financial Account Scamming Act (Republic Act No. 12010).

2. PERSONAL DATA WE COLLECT

We collect your personal data necessary to provide our products and services, including:

• Name, date of birth, gender, marital status, or any other particulars that are necessary to identify you;

• Contact details (e.g., mobile number, landline, email, address)

• Identification details (e.g., government-issued or other IDs and its images, and other digital photos and biometrics captured or submitted (selfies, fingerprints, etc.); 

• Financial and credit information (e.g., income, expenses, deposits, investments, and credit cards, transactions, credit data) 

• Employment and educational background and other similar information; 

• Health, genetic, or biometric data;

• Images and audio recordings captured by our CIMB Bank PH Mobile App or recorded through our official channels and lines; 

• Voice recordings of your conversations with our AI-powered systems, employees, or with our duly authorized agents;

• Your transactions with third parties, including merchants, product and service providers, and utility companies, done through our Mobile App or other related channels; 

• Non-personal information provided by the electronic device you are using such as the IP address, operating system, browser type and version, and other machine-related identifiers; and 

• Specimen signatures.

We may also collect additional information to perform due diligence and Know-Your-Customer (KYC) requirements, and to comply with regulatory requirements required for the maintenance of a banking relationship, including account opening, loan application, insurance coverages and other transactional account-related activities.

We may also collect the information of your emergency contact and/or the persons that you authorized to manage or use your account(s) or facility(ies) or products or services on your behalf, which you have provided to the Bank on the basis that you have obtained their consent to share and disclose, where required.  

We may also collect information about your family members, beneficiaries, attorneys-in-fact, shareholders, beneficial owners whenever applicable, persons under any trust, trustees, partners, committee members, directors, officers or authorized signatories, guarantors, and other security and other individuals.

3. LEGAL BASIS FOR PROCESSING

We process your personal data based on one or more of the following:

• When you have given us your consent, and/or knowingly disclosed, shared or provided us with your personal data;

• When it is necessary and related to the fulfillment of an agreement or contract between us, or in order to take necessary steps or requirements prior to entering into an agreement or contract with us;

• In compliance with any of our legal obligations under relevant laws and issuances of regulatory authorities;

• To protect vital interests, including life and health;

• To respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or

• If the collection and processing of personal data is for the purpose of legitimate interests pursued by CIMB Bank PH and its Affiliates, partners, service providers, merchants and other third-parties with whom CIMB Bank PH has an agreement with, except when such legitimate interest are overridden by your fundamental rights and freedoms which require protection under the Philippine Constitution.

4. PURPOSES OF PROCESSING

We process your personal data to:

• Verify your identity and perform Know-Your-Customer (KYC) procedures;

• Assess your eligibility and suitability for products or services;

• Facilitate and manage your transactions and accounts;

• Detect and prevent fraud, money laundering, and other crimes;

• Comply with legal and regulatory requirements;

• Improve our products, services, and customer experience;

• Provide you with relevant and more personalized communication about our services and products, subject to your preferences; and,

• Communicate with you regarding your transactions, updates, and customer support 

5. HOW WE COLLECT YOUR PERSONAL DATA

We collect your personal data through:

• Application forms and onboarding processes.

• The use of our mobile app.

• Communications you have with us made through our official channels, i.e. via our mobile app (including the help center), customer hotline, or email or when you transact with our employees, authorized representatives, agents, and service providers, including collection agencies. Official calls may be recorded.

• How you use and manage your account with us, including transactions and payments you have made.

• Other parties connected with you to verify your personal data, such as past or present employers, security providers, guarantors, and indemnitors. 

• Other parties you have given your information to and who you gave permission to share your information.

• Cookies on our website may collect your personal data, including but not limited to your computer’s IP address and locations.

6. USE OF COOKIES

We use cookies and similar technologies to:

• Store your preferences

• Improve website and app functionality

• Personalize your experience

• Conduct analytics and performance monitoring

You may manage your cookie preferences through your browser settings.

7. HOW WE USE YOUR PERSONAL DATA

We use your personal data to:

• Provide, maintain, and improve our banking products and services, including but not limited to updating and monitoring transactions in your account/s

• Personalize your customer experience 

• Conduct analytics, research, and reporting (with anonymized or aggregated data where possible)

• Perform risk management, credit scoring, and fraud detection 

• Send service-related communications and updates, including but not limited to changes to product features and services

• Update your personal data and your records with us.

• Contact you in case we may need to respond to your enquiries, complaints, or related disputes.

• Transfer or assign our rights, interests, and obligations under any of your agreements with us.

• Conduct anti-money laundering checks, for crime detection, investigation, prevention, and prosecution.

• Use your information for any other purpose that is required or permitted by any law, regulations, guidelines, and/or relevant regulatory authorities, including sharing or disclosing your information to government or regulatory authorities.

Where processing is based on your consent, you may withdraw your consent at any time, subject to legal or contractual limitations.

8. AUTOMATED PROCESSING AND ASSISTED DECISION-MAKING METHODS

We may automate the processing of your personal data. We may use the personal data we collect in this processing to conduct data analytics, including profiling and behavioral analysis, to assist or automate decisions in our business operations and to identify and evaluate potential risks. We require that rules followed by such automated systems are designed and tested to make fair and objective decisions. We have also implemented mechanisms in the automation process to allow for meaningful human intervention as an additional safeguard to the decision-making process.

We may also use specific artificial intelligence and machine learning to help improve our communications and client experience, make our business operational processes safer and more efficient and enable us to provide faster and consistent responses and improve turnaround time. For example, we may use these tools to assist us for the following:

• Chatbots and voicebots for customer engagement – communications and offers to recommend more tailored products and services based on insights from your personal data and interactions with such bots;

• Electronic Know-Your-Customer (eKYC) systems for customer onboarding – systems and algorithms may be used to verify the authenticity of scanned identification documents and photo(s) through image quality, biometric facial recognition and liveliness checks;

• Risk and anti-fraud management tools – monitoring of accounts and transactions to detect unusual activities for risks, unlawful activity, fraud, money laundering, terrorism and other financial crimes (for example, detecting possible misuse of your credit card for fraudulent purposes); and

• Credit-scoring models – to approve financing/loan applications and to facilitate credit decisions.

9. HOW WE PROTECT YOUR DATA

We implement appropriate physical, technical, and organizational security measures, policies and procedures in place to protect the confidentiality, integrity, and availability of your personal data. In building the systems and storage of your personal data, we integrated the principles of privacy-by-design and privacy-by-default and implemented industry security standards.

We use secure physical and digital storage facilities with strict role-based access controls, multi-factor authentication, encryption, firewalls, advanced security software, secure file transfer protocols, data minimization, pseudonymization and anonymization, among other industry standard protection and protocols. For artificial intelligence systems or automated processing systems, we regularly monitor and test these systems.  

10. SHARING OF YOUR PERSONAL DATA

We may share your personal data with the following parties, based on applicable legal bases (including consent where required):

• CIMB Group entities and affiliates, whether in or outside the Philippines;

• companies and persons that act as our agents, contractor, affiliates, service providers, merchant and strategic/ business partners, lawyers, auctioneers, valuers and/or professional advisers (including their sub-agents, sub-contractors, affiliates, service providers, professional advisors), and the employees, directors and officers of all the parties mentioned above, whether in or outside Philippines);

• companies and/or organizations that assist us in processing and/or otherwise fulfilling transactions that you have requested;

• companies and/or organizations that assist us in providing value added services that you have requested;

• companies and/or organizations that provide services to us in delivering or communicating information about our products and services to you;

• other banks and/or financial institutions, credit reference agencies, background investigation agencies, credit reporting agencies or credit bureaus,  any authority, central depository or depository agent in relation to the securities industry; the police; any other governmental or regulatory and authority or body, Credit Information Corporation, any insolvency department and our appointed debt recovery agents;

• any other person under a duty of confidentiality to us (including any entities within the corporate group of CIMB Group Holdings Berhad) which has undertaken to keep such information confidential;

• any trustees, beneficiaries, administrators or executors;

• your advisers (including but not limited to accountants, auditors, lawyers, financial advisers or other professional advisers) where authorized by you;

• any other person notified by you as authorized to give instructions or to use the account(s)/facility(ies) or products or services on your behalf;

• any third party as a result of any restructuring of facilities granted to you, assignment or transfer of rights and/or obligations, sale of debts, or the acquisition or sale of any company by CIMB Group, provided that any recipient uses your information for the same purposes as it was originally supplied to us and/or used by us;

• any guarantors or security providers for the facility(ies) granted by us to you;

• any person intending to settle any moneys outstanding under the facility(ies) granted by us to you;

• any rating agency, insurer/takaful provider or insurance broker or direct or indirect provider of credit protection;

• any financial institutions, merchants, card scheme operators, electronic-wallet (e-wallet) operators or payment service providers and their networks (including but not limited to VISA International Services Association, MasterCard International Incorporated, Alipay and their affiliates or members, both local and abroad) in relation to any credit card, debit card, e-wallet issued to you or for the remittance, payment or settlement transaction or service utilized by you;

• your intermediaries, correspondent and agent bank, clearing houses, clearing or settlement systems, market counterparties and any company you carry out investment services through us;

• any law enforcement, government, courts, dispute resolution bodies and regulatory bodies including but not limited to Bangko Sentral ng Pilipinas, Anti-Money Laundering Counsel, and their appointed personnel or party, and/or

• any person connected to the enforcement or preservation of any of our rights under your agreement(s) with us, subject at all times to any laws (including regulations, guidelines and/or obligations) applicable to the CIMB Group (whether in or outside the Philippines). The afore-mentioned third parties may in some instances be located outside of the Philippines.

“CIMB Group” refers to CIMB Group Holdings Berhad and all its related corporations, as defined in Section 7 of the Companies Act 2016 and jointly controlled companies, providing financial and other regulated services, excluding companies, branches, offices and other forms of presence operating outside of Malaysia unless and to the extent otherwise stated.

11. CROSS-BORDER DATA TRANSFERS

Your personal data may be transferred or stored outside the Philippines. Where this occurs, CIMB Bank PH ensures that:

• Appropriate safeguards are in place, including contractual protections

• The level of data protection is comparable to Philippine standards

• Processing complies with applicable laws and regulations

12. ACCESS AND CORRECTION

You may access or update your personal data by:

• Logging into your CIMB Bank PH Mobile App

• Contacting our Customer Care channels indicated in our official website and CIMB Bank PH Mobile App

We will act on your request within a reasonable period, subject to identity verification and applicable laws.  

We may withhold access to your personal data in certain situations, for example, when we are unable to confirm your identity or in the event we receive repeated requests for the same information. 

13. DATA RETENTION 

We retain your personal data:

• For the duration of your relationship with CIMB Bank PH; and 

• For at least seven (7) years after account closure or longer if required by law (e.g., AMLA, BSP regulations) or court order.

After the applicable retention period, your personal data will be securely deleted or anonymized.

14. DISPOSAL OF PERSONAL DATA

Upon expiration of the retention period, we securely dispose of personal data through:

• Secure deletion of digital records

• Destruction of physical documents

• Anonymization where applicable

15. MARKETING PREFERENCES

You may opt-out of marketing or promotional communications from CIMB Bank PH at any time. Simply follow the opt-out or unsubscribe steps provided in the channel/s you wish to stop receiving communications. The opt-out shall be determined on a per channel level. You may incur additional costs for opting out of communications depending on the policy of the channel.

Opt-out only affects marketing or promotional communications. We cannot remove certain communications, such as but not limited to, customer advisories, transaction histories, security tips, and other regulatory requirements. Removal of these may affect the delivery and provision of our services and products, and the operation of your account(s) or facility(ies) with us.

16. DATA BREACH NOTIFICATION

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, CIMB Bank PH will notify you and the National Privacy Commission in accordance with applicable laws and regulations.

17. COMPLAINTS

If you have concerns about how your personal data is processed, you may contact our Data Protection Officer.

If you are not satisfied with our response, you may file a complaint with the National Privacy Commission.

18. CONTACT US

For inquiries or concerns regarding your personal data, you may contact:

Data Protection Officer 
CIMB Bank Philippines Inc. 
Email: CIMBPH_DPO@cimb.com 
Address: 22nd Floor, Bonifacio Corporate Center, 2nd Avenue and 31st Street, Bonifacio Global City, Taguig City, National Capital Region, Philippines 
 

All non-data privacy emails sent to the DPO email address may not be responded to. Kindly refer to our Help Center or to the customer service contact information found on our website for other concerns or inquiries.

19. UPDATES TO THIS PRIVACY NOTICE

This Privacy Notice may be revised from time to time. Any changes will be made available through our official channels, including our website and CIMB Bank PH mobile application.

Last Updated: May 2026