The Brankas Privacy Notice and Consent Form (Privacy Notice) applies to Brankas Pte. Ltd. and its subsidiaries (collectively "Brankas", "we", "our" or "us"). This Privacy Notice represents our commitment to treat your personal information with the utmost care, transparency, and confidentiality. This Privacy Notice (only covers the information that Brankas collects, uses, and shares. It does not explain what the third party with which you have an underlying obligation does with any information they may collect about you, separately from Brankas. This Privacy Notice also does not cover any websites, platforms, products, or services provided by third parties. We encourage you to review the privacy policies or notices of third parties for information about their practices, and we hope you will take some time to read this Privacy Notice.

With this Privacy Notice, we present transparently that we gather, store, and handle personal data fairly and in accordance with the law. As part of our drive to serve you better, we need to obtain and process your information. This includes any offline or online data that makes a person identifiable such as names, addresses, usernames and passwords, digital footprints, photographs, social security numbers, financial data, etc.

Brankas collects or processes this information only with end users’/data subjects’ full knowledge, cooperation, and consent. Once this information is available to us, the following rules apply.

Your data will be kept up-to-date, collected, or processed fairly and for lawful purposes only. The information you give us will be processed within legal boundaries in accordance with the applicable data privacy law in which you are located and will be protected against any unauthorized or illegal access by internal or external parties. You are free to exercise your rights under the law as a Data Subject, and we fully respect the same.

Your data will not be distributed to any party other than the ones you have consented to and agreed to (exempting those compellable to be disclosed by law and legitimate requests from courts of competent jurisdiction and law enforcement authorities). Without your express consent as the Data Subject, your data will not be communicated or transferred, informally or in any manner, to any other person, entity, organization, or country.

In addition to our methods of handling the data, Brankas has direct obligations toward Data Subjects to whom the data belongs. We allow Data Subjects to modify, erase, reduce, or correct data contained in our databases in line with their rights under the applicable privacy law in which they are located. We maintain provisions in our systems in cases of lost or corrupted data.

Brankas is committed to restricting and monitoring access to sensitive data for your protection. Our officers and employees will be trained in online privacy and data security and establish data protection practices and policies (secure locks, data encryption, access authorization, etc.). In addition, security measures will be built through a secure network to protect data from cyber-attacks.

We may change this Privacy Notice from time to time. If we make changes to our Privacy Notice, we will announce such a fact on the Brankas website (https://brankas.com) and other communication channels within 7 (seven) working days after the changes take effect with the effective date updated at the top of this Privacy Notice. In case of any inconsistency with other

Brankas policies regarding data, information, and system security measures, this Privacy Notice shall prevail. For any questions or concerns regarding this Privacy Notice, you may send them to privacy@brankas.com or chat, through the widget in the lower right corner, with our Support Team at https://brankas.com.

Thank you for using Brankas!

Data Subject refers to an individual (e.g. the end-user of the Brankas service) whose Personal Data is collected or processed;

Personal Data refers to any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Processing refers to any operation performed upon Personal Data including, but not limited to, collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking erasure, or destruction of data. Processing may be performed through automated means or manual processing.

Specific Personal Data refers to Personal Data:

1. personal finances, including but not limited to bank deposit data including savings, deposits, and credit cards.
2. about a person’s race, ethnic origin, marital status, age, color, religious affiliation, philosophy, or politics;
3. about a person’s health, education, genetic or sexual life, or any legal process for any offense committed or alleged to have been committed by that person, the completion of such legal process, or the punishment of any court authorized in respect of such proceedings;
4. issued by government agencies specifically for individuals that include, but are not limited to, social security numbers, residence identities, previous or current health records, their permits or refusals, their suspension or revocation, and tax returns (tax returns); and
5. specifically stipulated by executive orders or legislation to be kept confidential.

Section 2.1
Information Brankas Collects - Brankas collects your (or "you") Personal Data, which, where applicable, may include credentials such as user name and password or security token. In some cases, we also collect your phone number, email address, and one-time password (OTP) to help verify your identity before providing our services to you. When providing this information, you give Brankas permission to act on your behalf to access, use, disclose, and share your Personal Data from relevant banks or other entities (i.e., providers of financial products and services) to provide our services for your use. Further, with your consent and at the request of your financial services provider, Brankas may store your credentials, such as username, password, OTP, and token number, which are generated digitally or through hard tokens. The data will be stored on the servers of the Company or a third-party provider. If we use your data beyond this state purpose, Brankas will ask for your consent anew. We uphold the confidentiality and privacy of your data. You can also provide us with other information, including your name, email address, and phone number.

The specific information we collect from your bank or financial product and service providers depends on the service you availed from us. Overall, this includes:

1. Account information, including financial institution name, account name, account type, and account ownership;
2. Information about an account balance, including current and available balance, and source of funds;
3. Information about account transactions, including amount, date, payee, type, quantity, price, location, involved securities, and a description of the transaction;
4. Information about credit accounts, including due dates, balances owed, payment amounts and dates, transaction history, credit limit, repayment status, and interest rate;
5. Information about loan accounts, including due dates, repayment status, balances, payment amounts and dates, interest rate, guarantor, loan type, payment plan, and terms; and
6. Information about the account owner(s), including but not limited to name,home address, marital status, nationality, work, email address, and phone number.

When you use your device to connect to our services, we receive identifiers and electronic network activity information about that device, including IP address, device type, the country where the device is located, the services you access, and other technical information about the device. We also use cookies or similar tracking technologies to collect aggregated usage statistics and to help us improve your experience. Cookies never store any of your banking details.

Upon using our services, if you have given consent to process your Personal Data, and later on you change your mind, you may withdraw your consent by contacting us via privacy@brankas.com.

Section 2.2
Basis for Processing Your Personal Data - Our legal basis for processing your Personal Data will depend on the information concerned and the context in which we collected or processed it. Generally, however, we will normally only collect and process Personal Data where:

1. fulfillment of our responsibilities and obligations in any contract or agreement with you (for example, to comply with our services agreements);
2. fulfillment of our responsibilities and obligations in any contract or agreement with our Clients, as data controller, and our obligations as a data processor;
3. to comply with our legal obligations under applicable law;
4. processing is necessary for our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms (for example, to safeguard our services; to communicate with you, or to update our services); or
5. you have given your consent to do so.

To the extent we rely on consent to collect and process Personal Data, you have the right to withdraw your consent at any time per the instructions provided in this Privacy Notice.

Section 2.3
How Brankas Uses Your Personal Data – With your consent, we use your Personal Data for a number of business and commercial purposes, including to operate, improve, and protect the services we provide and to develop new services. More specifically, we use your Personal Data:

1. To provide, operate, and maintain our services, which you intend to avail of;
2. To improve, modify, add to, and further develop our services;
3. To develop new services;
4. To protect you, our partners, and others from fraud, malicious activity, and other privacy and security-related concerns;
5. To provide customer support to you, including helping respond to your inquiries related to our service;
6. To investigate any misuse of our service, criminal activity, or other unauthorized access to our services;
7. To notify you about our latest service that may be tailored to your need; and
8. For any other purpose, notified subject to your explicit consent and taking into account the objectives, needs, and balance of the interests of Brankas and the rights of the Data Subject.

Section 2.4
How Brankas Shares Your Personal Data – With your specific consent and only in specific instances, we share your Personal Data for a number of business purposes:

1. To enforce any contract with you;
2. With our data processors and other service providers, merchants, partners, or contractors in connection with the services they perform for us and subject to any data outsourcing agreement they have with us;
3. With our Clients, who are data controllers, pursuant to our Data Outsourcing Agreement with them, who must have likewise obtained your explicit consent;
4. If, in good faith, disclosure is appropriate to comply with applicable law or legal process;
5. In connection with a change in ownership or control of all or a part of our business (e.g. merger, reorganization, bankruptcy, etc.);
6. Between and among Brankas affiliated entities such as parents, affiliates, subsidiaries, and other companies under common control or ownership, subject to any data-sharing agreement among such entities;
7. To reasonably protect the rights, privacy, safety, or property of Data Subjects such as yourself, us, our partners, and others; or
8. For any other notified purpose subject to your consent.

Section 2.5
Transfer of Personal Data outside the Jurisdiction of the Philippines, Indonesia, Singapore,Thailand, Vietnam, and other countries – Brankas operates in Southeast Asia and other countries and may transfer Personal Data to other personal data controllers outside the jurisdiction of the aforementioned countries which may have data protection rules different from those of your residence or place of domicile. We will take appropriate measures to ensure that:

1. the country in which the controller of such other personal data or international organization receives the transfer of Personal Data has a level of protection of Personal Data equal to or higher than stipulated in the prevailing laws and regulations;
2. there are international agreements between countries;
3. there is a contract between personal data controllers and personal data processors/controllers that have standards and/or guarantees of protection of personal data following the applicable laws and regulations; and/or
4. data subject’s consent is obtained for this purpose.

Section 2.6
Retention Period of Personal Data – For the processing of such Personal Data, we will only retain Personal Data for 3 years under our Retention Policy. When such retention period ends or at the request of the Data Subject, the Personal Data we have processed will be deleted or destroyed, or removed from the list, with the exception of other decisive laws and regulations.

Section 2.7 Other - We may collect, use and share your Personal Data aggregated or anonymously (without personally identifying you) for any purpose permitted by law, including creating or using data collected or anonymized based on Personal Data collected to develop new services and to facilitate research subject to your explicit consent. We do not sell or lease out Personal Data or any information we collect.

Section 3.1
Data Privacy Principles - All Processing of Personal Data within Brankas will be conducted in compliance with the following data privacy principles:

1. the collection of Personal Data is limited and specific, legally valid, appropriate, and transparent;
2. the processing of Personal Data is carried out in accordance with its purposes;
3. the processing of Personal Data is carried out by guaranteeing the rights of the Data Subjecta;
4. the processing of Personal Data is accurate, complete, not misleading, current, and accountable;
5. the processing of Personal Data is done by protecting the security of Personal Data from unauthorized access, unauthorized disclosure, unauthorized alteration, misuse, destruction, and/or loss of Personal Data;
6. the processing of Personal Data is carried out by notifying the purposes and activities of the processing, as well as the failure to protect personal data;
7. the processing of Personal Data is carried out responsibly by fulfilling the implementation of the principles of protection of Personal Data and can be clearly proven.
8. the destruction and/or deletion after the retention period ends or at the request of the Data Subject unless otherwise provided by the legislation.

Section 3.2
Data Processing Records – We will maintain adequate and up-to-date records of Personal Data Processing activities at all times. These records shall include, at the minimum:

1. Information about the purpose of the Processing of Personal Data, including any intended future Processing or data sharing;
2. A description of all categories of Data Subjects, Personal Data, and recipients of such Personal Data that will be involved in the Processing;
3. General information about the data flow within Brankas, from time of collection and retention, including the time limits for disposal or erasure of Personal Data;
4. A general description of the organizational, physical, and technical security measures in place within Brankas; and
5. The name and contact details of any staff accountable for ensuring compliance with the applicable laws and regulations for the protection of data privacy and security.

Brankas will annually conduct a privacy impact assessment relative to all activities, projects, and systems involving the Processing of Personal Data in line with our internal policies. We will periodically review security policies, conduct vulnerability assessments, and perform penetration testing, as applicable, within Brankas on a regular schedule to be prescribed by our IT Team.

Section 3.3
Personal Data Management – We will develop and implement measures to ensure that all Brankas staff who have access to Personal Data will strictly process such data in compliance with applicable laws and regulations. These measures may include drafting new or updating relevant policies of Brankas and conducting learning and development programs or sponsoring training programs to educate our stockholders, directors, officers, employees, agents, and other interested parties on data privacy-related concerns.

We will obtain your informed consent, evidenced by written, electronic, or recorded means, concerning:

1. The Processing of your Personal Data, for purposes of maintaining Brankas’ records;
2. The sharing of your Personal Data with a third party, if necessary, is subject to the requirement that you will be provided with the following information before your Personal Data is shared:
   1. Identity of the third party that will be given access to the Personal Data;
   2. Purpose of the data sharing;
   3. Categories of Personal Data concerned;
   4. Intended recipients or categories of recipients of the Personal Data;
   5. Existence of your rights as Data Subject, including the right to access and correction, and the right to object; and
   6. Other information that would sufficiently notify you of the nature and extent of data sharing and the manner of Processing.

A continuing obligation of confidentiality is imposed on our stockholders, directors, officers, employees, agents, or other interested parties in connection with the Personal Data that they may encounter during the period of which they are such with Brankas. This obligation will still apply after they cease to work with Brankas for whatever reason.

Section 3.4
Data Collection Procedures – We will document our Personal Data Processing procedures. We ensure that these procedures are updated and that your consent is properly obtained when required by law and evidenced by written, electronic, or recorded means. These procedures will also be regularly monitored, modified, and updated to ensure that your rights as a Data Subject are respected and that we process your Personal Data according to law.

Section 3.5
Delays and Restrictions on Data Processing – We will delay and restrict the processing of Personal Data in part or whole no later than 2 (two) working days from the time we receive the request for delay and restriction of processing of Personal Data from the Data Subject.

Section 3.6
Internal Monitoring – Brankas will regularly supervise any party involved in the processing of Personal Data under the control of Brankas.

Section 3.7
Provision of Personal Data access – Brankas provides the Data Subject with access to the processed Personal Data along with a track record of processing Personal Data in accordance with the period of retention of the Personal Data. The provision of such access is granted no later than 3 (three) working days from the date the Personal Data Controller receives the access request.

Section 3.8
Denial of access to Personal Data – Brankas may refuse to grant personal data access to data in the event of known or should be expected:

1. jeopardize the safety or physical health or mental health of data subjects and/or others;
2. impact on the disclosure of other people’s Personal Data; and/or
3. contrary to national defense and security interests.

Section 3.9
Personal Data Update and Correction – Brankas will update and/or correct any errors and/or inaccuracies in Personal Data within three (3)working days from the time Brankas receives a request for updating and/or repairing personal data via privacy@brankas.com or chat, through the widget in the lower right corner, with our Support Team at https://brankas.com.

Section 3.10
Guarantees for the accuracy, completeness, and consistency of Personal Data – Brankas guarantees the accuracy, completeness, and consistency of Personal Data in accordance with the provisions of the laws and regulations under which it operates. Brankas conducts verification of such processed Personal Data.

Section 3.11
Termination of processing of Personal Data – Brankas will terminate the processing of Personal Data if:

1. has reached retention period;
2. the purpose of processing Personal Data has been achieved; or
3. there is a request from Data Subject.

Section 3.12
Deletion or destruction of Personal Data – Brankas will delete Personal Data if:

1. Personal Data is no longer necessary for the achievement of the purposes for which personal data is processed;
2. the Data Subject has withdrawn consent to the processing of Personal Data;
3. there is a request from the Data Subject
4. the retention period has lapsed; or
5. Personal Data is obtained and/or processed unlawfully.

Section 3.13
Appointment of a Data Protection Officer – Brankas may appoint an officer or officer who performs the functions of personal data protection and has the following obligations and responsibilities:

1. inform and advise Brankas as the controller/processor, as may be applicable, of Personal Data to comply with the provisions in the prevailing laws and regulations;
2. monitor and ensure compliance with applicable laws and regulations and privacy policies, including assignment, responsibility, awareness-raising, and training of parties involved in the processing of Personal Data, and related audits;
3. provide advice on assessing the impact of processing activities and monitoring the performance of Brankas as a personal data controller and personal data processor; and
4. coordinate and act as a contact person for issues relating to the processing of Personal Data, including consulting on risk mitigation and/or other matters.

The Data Protection Officerr performing the protective function of such Personal Data shall be appointed based on professional quality, knowledge of the laws and practices of personal data protection, and the ability to fulfill its duties, as well as pay attention to risks associated with the processing of Personal Data, taking into account the nature, scope, context, and purpose of processing.

Section 4.1
General Security - Brankas is ISO 27001 and PCI DSS certified which requires rigorous testing and evidence to ensure that the organization maintains a highly secure environment. We work to protect the security of your information during transmission by using Secure Sockets Layer/Transport Layer Security (SSL/TLS) software, which encrypts information You input and we encrypt data at rest under the 256-bit Advanced Encryption Standard. In line with our certifications, our IT team will continuously develop and evaluate the following this Privacy Notice, considering the following:

1. Safeguards to protect Brankas computer network and systems against accidental, unlawful, or unauthorized usage, any interference which will affect data integrity or hinder the functioning or availability of the system, and unauthorized access;
2. Our ability to ensure and maintain the confidentiality, integrity, availability, and resilience of Brankas data processing systems and services;
3. Regular monitoring for security breaches, and a process for identifying and accessing reasonably foreseeable vulnerabilities in Brankas computer network and system, and taking preventive and corrective actions against security incidents that can lead to a Personal Data breach;
4. Our ability to restore the availability and access to Personal Data promptly in the event of a physical or technical incident;
5. A process for regularly testing and evaluating the effectiveness of security measures;
6. Encryption of Personal Data during storage and while in transit, authentication process, and other technical security measures that control and limit access thereto; and
7. Our determination of the level of security of Personal Data takes into account the nature and risks of Personal Data that must be protected in the processing of Personal Data.

Section 4.2 Monitoring for security breaches – We install updated versions of anti-virus software on electronic computing devices that access the internet or wifi connections (desktops, notebooks, smartphones, iPads, and similar devices). We also use an intrusion detection system to monitor security breaches and alert us of any attempt to interrupt the system.

Section 4.3
Security features of the software/s and application/s use - All software applications are reviewed and evaluated by our IT team before installing these in Brankas computers and devices to ensure the compatibility of security features with overall operations.

Section 4.4
Encryption, authentication process, and other measures - Brankas personnel with access to Personal Data will verify their identity using a secure encrypted link and multi-level authentication as adopted by the IT Team.

As Data Subjects, you have the following rights in connection with the Processing of your Personal Data: the right to be informed, right to object, right to access, right to rectification, right to erasure or blocking, and right to damages. Stockholders, directors, officers, employees, and agents of Brankas are required to strictly respect and obey the rights of the Data Subjects.

Section 5.1 Right to be Informed – You have the right to be informed whether your Personal Data will be, is being, or has been processed. You will be notified and furnished with the information indicated below before the entry of your Personal Data into our records:

1. Description of the Personal Data to be entered into the system;
2. Brankas identity as a personal data controller;
3. Purposes for which they are being or will be processed, including Processing for direct marketing, profiling, or historical, statistical, or scientific purposes;
4. Basis of Processing, when Processing is not based on your consent;
5. Scope and method of Personal Data Processing;
6. The recipients to whom the Personal Data are or may be disclosed or shared;
7. Methods utilized for automated access, if you allow the same, and the extent to which such access is authorized, including meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing for you;
8. The period for which the Personal Data will be stored; and
9. The existence of your rights as a Data Subject, including the right to access, correct, and object to the Processing.

Section 5.2
Right to Object - You have the right to object to the Processing of your Personal Data, including Processing for direct marketing, automated Processing, or profiling. You will also be notified and given an opportunity to withhold consent to the Processing in case of changes to the information supplied or declared to you in the preceding section. When you object or withhold consent, we will no longer process your Personal Data, unless:

1. The Personal Data is collected or processed under a legal process or needed to comply with a legal obligation; or
2. The Processing is for obvious purposes, including when it is necessary for the performance of or concerning a contract to which you are a party, or when necessary or desirable in the context of an employer-employee relationship between you and us.

Section 5.3
Right to Access - You have the right to reasonable access to, upon demand, the following, if such information is available to us:

1. Contents of your Personal Data that were processed;
2. Sources from which Personal Data were obtained;
3. Names and addresses of recipients of the Personal Data;
4. Manner by which your Personal Data were processed;
5. Reasons for the disclosure of the Personal Data to recipients;
6. Information on automated processes where the Personal Data will, or is likely to, be made as to the sole basis for any decision that significantly affects or will affect you; and
7. Date when Personal Data concerning you were last accessed and modified.

Section 5.4
Right to Rectification – You have the right to dispute the inaccuracy or rectify the error in your Personal Data, and we will correct it immediately and accordingly unless the request is vexatious or otherwise unreasonable. If the Personal Data has been corrected, we will ensure accessibility of both the new and the retracted Personal Data and the simultaneous receipt of the new and the retracted Personal Data to the intended recipients. In connection with this, recipients or third parties who have previously received such processed Personal Data will be informed of its inaccuracy and rectification upon reasonable request.

Section 5.5
Right to Erasure or Blocking/Delisting - You have the right to suspend, withdraw, or order the blocking, delisting, removal, or destruction of your Personal Data from our system. This right may be exercised upon discovery and substantial proof of any of the following:

1. The Personal Data is incomplete, outdated, false, or unlawfully obtained;
2. The Personal Data is being used for purposes not authorized by you;
3. The Personal Data is no longer necessary for the purpose for which they were collected;
4. The Personal Data concerns private information that is prejudicial to you or other Data Subjects unless justified by freedom of speech, expression, or authorized by law;
5. The Processing is unlawful;
6. You or other Data Subjects’ rights have been violated; or
7. You withdraw consent or object to the Processing, and there is no other legal ground or overriding legitimate interest for us to continue the Processing;

We will notify third parties who have previously received such processed Personal Data that you have withdrawn consent or objected to the Processing thereof upon reasonable request.

Section 5.6
Right to Object – The Data Subject reserves the right to object to decision-making actions based solely on the automated processing of a person’s profile(profiling).

Section 5.7
Right to Indemnification – The Data Subject reserves the right to sue and receive damages for the breach of his/her Personal Data in accordance with the provisions of the laws and regulations.

Section 5.8
Transmissibility of Rights of Data Subjects – Your lawful heirs and assigns may invoke your rights as the Data Subject at any time after your death, or when you become incapacitated or incapable of exercising your rights.

Section 5.9
Data Portability – When we process your Personal Data through electronic means and in a structured and commonly used format, you will have the right to obtain a copy of such data in an electronic or structured format that is commonly used and allows for your further use. The exercise of this right will primarily take into account your right to have control over your Personal Data being processed based on consent, for commercial purposes, or through automated means.

Section 6.1
Data Breach Notification - All our stockholders, directors, officers, employees, and agents involved in the Processing of Personal Data are tasked with regularly monitoring for signs of a possible data breach or security incident. In the event that such signs are discovered, facts and circumstances will be reported to our authorized personnel within 24 hours from discovery for verification as to whether or not a breach requiring notification to regulators has occurred. If there is a breach of such nature, we will notify any relevant government authority and affected Data Subjects according to the requirements and procedures prescribed by law.

The notification will at least describe the nature of the breach, the Personal Data possibly involved, and measures are taken by Brankas to address the breach. The notification will also include measures taken to reduce the harm of the breach and the name and contact details of Brankas’ authorized personnel. The form and procedure for notification will conform with the law.

Section 6.2
Breach Reports - All security incidents and Personal Data breaches will be documented through written reports, including those not covered by notification requirements. In the case of Personal Data breaches, a report will include the facts surrounding an incident, the effects of such incident, and the remedial actions taken by Brankas. In other security incidents not involving Personal Data, a report containing aggregated data will be sufficient.

If there is a suspected violation of Personal Data committed by Brankas and/or a party affiliated with us that can be proven legally, then the aggrieved Data Subject or other related parties may file a dispute resolution through arbitration, court, or other alternative dispute resolution institution following the provisions of the laws and regulations. The law applicable in dispute resolution and/or the process of personal data protection court shall be carried out based on the applicable law in accordance with the provisions of the legislation. Valid evidence in the process of resolving this dispute is a tool of evidence as referred to in the law of the event and other evidence tools in the form of electronic information and/or electronic documents in accordance with the legislation. If it is necessary to protect Personal Data, the proceedings will be conducted privately.

Any Personal Data Processing conducted by an external agent or entity (third-party service provider) on our behalf should be evidenced by a valid written contract with us. The contract should expressly set out the subject matter and duration of the Processing, the nature, and purpose of the Processing, the type of Personal Data and categories of Data Subjects, our obligations and rights, and the geographic location of the Processing under the contract.

The fact that we entered into such an arrangement does not give the said external agent or entity the authority to subcontract to another entity the whole or part of the subject matter of said arrangement unless expressly stipulated in writing. The subcontracting agreement will also comply with the criteria prescribed by the preceding paragraph.

In addition, both foregoing contracts described will include express stipulations requiring the external agent or entity (including the subcontractor) to:

1. Process the Personal Data only upon our documented instructions, including transfers of Personal Data to another country or an international organization, unless such transfer is required by law;
2. Ensure that an obligation of confidentiality is imposed on persons and employees authorized by the external agent/entity and subcontractor to process the Personal Data;
3. Implement appropriate security measures;
4. Comply with applicable laws and regulations, in addition to the obligations provided in the contract, or other legal act with the external party;
5. Not engage another processor without our prior instruction, and any such arrangement will ensure that the same obligations for data protection under the contract or legal act are implemented, taking into account the nature of the Processing;
6. Assist us, by appropriate technical and organizational measures, and to the extent possible, fulfill the obligation to respond to requests by Data Subjects relative to the exercise of their rights;
7. Assist us in ensuring compliance with the law, taking into account the nature of Processing and the information available to the external party;
8. At our discretion, delete or return all Personal Data to us after the end of the provision of services relating to the Processing, including the deletion of existing copies unless storage is authorized by law;
9. Make available to us all information necessary to demonstrate compliance with the law, and allow for and contribute to audits, including inspections, conducted by another auditor mandated by us or us; and
10. Immediately inform us if, in its opinion, an instruction violates the law.

We have enumerated Brankas products that collect information about you and the uses of the information collected. Kindly note that these Brankas products are enumerated here as of the effective date of this Privacy Notice and may not include products or services in development as of that date.

1. Brankas Tap is a trusted front-end interface that allows you to securely log in using your credentials with your online banking accounts to complete transactions. Brankas Tap’s data flow integrates itself with your online bank application. Once you are logged in, your bank’s security features, such as authentication by requesting OTPs and TFAs and validation, occur before your transaction is completed. We collect your information as specified in section 2.1 of this Privacy Notice.
2. Brankas Direct is a fund transfer service that allows you to initiate fund transfers instantly and digitally through our web and mobile applications. Brankas Direct serves as a single point of integration for our partners through which you can execute fund transfers via various banks with which Brankas is integrated. Brankas Direct allows you to transfer directly using your bank. Brankas Direct does not impose any fees on your transaction. However, there may be certain fees imposed by our Client. For further information, please refer to our Terms of Use. The transaction is processed directly from your source bank account to the beneficiary bank account, and at no point does Brankas hold funds. No extra transaction fees are charged for using our Service. We collect your information as specified in section 2.1 of this Privacy Notice.
3. Brankas Statement is one of our data information products that allow our Clients to instantly retrieve comprehensive financial and personal data from you. It allows our clients to retrieve financial data, such as transaction and account data, from multiple financial institutions through a single integration. This empowers data sharing via industry-leading standard encryption technology in place and only with your consent. The data retrievals period ranges from 2 weeks to 180 days, depending on respective banks/e-wallets.