DATA PRIVACY POLICY

Lopue’s Rewards, Rewards Programs, and Credit Accounts

Last Updated: January 31, 2026

Data Privacy Controller:
Lopue’s San Sebastian Corporation

1. Introduction

Lopue’s San Sebastian Corporation (“the Company”) respects your right to privacy and is committed to protecting your personal data in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

This Data Privacy Policy explains how the Company collects, uses, stores, shares, and protects personal data in connection with the following Company programs and services:

• Lopue’s Rewards – the mobile application

• Great Rewards – the rewards program used in Lopue’s San Sebastian stores

• Suki Card – the rewards program used in Lopue’s Value Store branches

• Credit Programs, including but not limited to:

  • FPP (Four Payment Plan)

  • Regular Charge Account

This Policy applies to personal data collected through mobile applications, in-store or in-person registration, paper or electronic application forms, customer service desks, and other lawful transaction channels of the Company.

2. Personal Data Collected

Depending on the program or service applied for, the Company may collect the following personal data:

• Full name

• Home and billing address

• Mobile number and email address

• Valid government-issued identification details

• Employment or business information

• Credit, payment, and account details

• Purchase, transaction, and payment history

• Rewards and membership account details

• App usage and basic device information (for app users)

The Company collects only personal data that is adequate, relevant, and necessary for the applicable program or service.

3. Manner of Collection

Personal data may be collected through:

• Registration and use of the Lopue’s Rewards mobile application

• In-store or in-person enrollment for rewards or credit programs

• Paper or electronic credit and account application forms

• Information voluntarily provided to authorized Company personnel

• Transactions related to rewards, purchases, payments, or account servicing

4. Purpose of Processing

Personal data is collected and processed for the following purposes:

A. Rewards Programs

• Registration, verification, and administration of rewards accounts

• Tracking, awarding, and redemption of points, rewards, and benefits

B. Credit Programs (FPP and Regular Account)

• Evaluation and approval of credit or payment applications

• Verification of identity, employment, or financial information

• Creation, administration, and servicing of credit accounts

• Monitoring of account usage, payments, and outstanding balances

• Collections, account enforcement, and dispute resolution

C. General Purposes

• Communication of important account, billing, rewards, or service updates

• Sending occasional SMS or push notifications related to accounts, rewards, or promotions

• Improvement of systems, services, and customer experience

• Compliance with legal, regulatory, and reporting requirements

5. Lawful Basis for Processing

The processing of personal data is based on the following lawful grounds:

• Consent of the data subject

• Performance of a contract, including credit and rewards agreements

• Compliance with legal obligations, including record-keeping and reporting

6. Data Sharing and Disclosure

Personal data may be disclosed only to:

• Authorized service providers who assist in credit evaluation, systems operation, billing, or collections

• Banks, payment processors, or financing partners, where applicable

• Government authorities, regulators, or law enforcement agencies when required by law

All third parties are required to observe appropriate confidentiality and data protection measures.

The Company does not sell personal data to third parties.

7. Data Protection and Security Measures

The Company implements reasonable and appropriate organizational, physical, and technical security measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, misuse, or unauthorized access.

Access to personal data is limited to authorized personnel on a strict need-to-know basis.

8. Data Retention

Personal data is retained only for as long as necessary to:

• Fulfill rewards or credit program purposes

• Comply with accounting, audit, tax, and regulatory requirements

• Enforce contractual or legal rights

When no longer required, personal data is securely disposed of or anonymized.

9. Rights of Data Subjects

In accordance with the Data Privacy Act, data subjects have the right to:

• Be informed

• Access their personal data

• Object to processing

• Request correction of inaccurate or outdated data

• Request erasure or blocking, subject to lawful grounds

• Withdraw consent, subject to contractual and legal limitations

• Lodge a complaint with the National Privacy Commission

10. Changes to This Policy

This Policy may be updated to reflect changes in laws, programs, or business practices. Updated versions will be posted on the Company’s website and made available upon request.

11. Contact Information

For privacy-related concerns, you may contact:

Lopue’s San Sebastian Corporation
Email: info@lopues.com
Phone: 4333171 to 75

12. Consent

By applying for or participating in any rewards program or credit account, whether through digital or in-person application, you acknowledge that you have read and understood this Data Privacy Policy and agree to the collection and processing of your personal data as described.