Privacy Notice - EO - Executive Optical

Executive Optical, Inc. (“EO-Executive Optical”, “Company”, “we”, “us”, “our”) is fully committed to protecting and respecting your personal data privacy. We prioritize the responsible processing of your personal data, in accordance with the Data Privacy Act of 2012, its Implementing Rules and Regulations, and related issuances of the National Privacy Commission (“the Commission” or “NPC”) (“Data Privacy Laws”).

This Notice covers our online collection of data done through this website, and our official accounts with third-party platforms, networks and applications. This likewise covers our offline data collection using our manual forms.

PATIENTS AND CUSTOMERS

We will collect your personal data when you open your online account. To facilitate your membership application and to process your future online transactions, discounts, claims and refunds, we need to collect the following information from you: • Name; • E-mail address; • Phone number; and • Address. We will also collect the following personal data for all transactions done manually, or using our official accounts in Grab Mart, Pickaroo, Zalora, Shopee, Lazada and social media (Facebook, Instragram, Tik Tok, and Viber): • Name; • Contact Number; and • Delivery Address. For patient’s assessment, we may collect the following information to ensure that you get proper prescription from our optometrist: • Name; • Birthdate; • Phone number; • PWD ID or Senior Citizen ID; and • Health record or prescription from your ophthalmologist. For other customer-related concerns raised using Contact Us or live chat, we will be asking for your: • Name; • E-mail address; and • Other relevant data to give you full customer experience.

VIRTUAL TRY-ON

The virtual try-on feature is powered by a third-party provider, Fitting Monster. You may check their privacy policy here.

APPLICANTS AND EMPLOYEES

We will collect your personal data when you apply to us through the Careers page or other social media platform (LinkedIn and Jobstreet). To process your employment application and other human resource-related transaction, we need to collect the following from you: • Name; • E-mail address; • Contact information; and • Other information in your Curriculum Vitae. Before your onboarding, we will collect additional information. These are: • Birth Date; • Birth place; • Photo; • Gender; • Marital Status; • Citizenship/Nationality; • Email Address; • Home Address; • Home Telephone Number; • Signature; • TIN, SSS, HDMF and PhilHealth Number; • PRC ID; • Medical Clearance; • Educational Background; • Bank Account Number; • Relative or Acquaintance in the Company; and • Contact Person and his/her contact information. We may further collect information relevant to your application or employment with the Company.

CORPORATE PARTNERS

We will collect your personal data when you submit your application as a corporate partner in our website. We will collect your: • Name; and • E-mail Address. We may likewise collect your contact number and other personal data relevant to your application.

We never pass on, sell or swap your data to third parties for purpose other than your agreement with the Company. We may share and transfer personal data to our affiliates and subsidiaries (associated companies), service providers, agents, hospitals/clinics, or companies that are acting on behalf of the Company, for the purposes outlined on this Privacy Notice. We will only disclose your data outside the scope of our purpose when such disclosure is allowed under Section 12 or 13 of the Data Privacy Act.

We have taken physical, technical, and administrative measures to protect your data from loss, manipulation, unauthorized access, copying, etc. We restrict access to personal data, maintain technology products, conduct regular vulnerability assessments, and securely destroy personal data when no longer needed. We continually adapt our security measures in line with technological progress and developments.

All collected and processed personal data will be stored in our data center located within the Philippines and/or on Cloud Computing Services – Amazon Web Services (AWS). To know more about your personal data storage and how your personal data is being protected under AWS Cloud, you may click here.

We will retain your Personal Data as long as it is necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required under the applicable laws or regulations. We will properly dispose your data in case the Company no longer needs it for any of the purposes above, relevant to your transaction with us. Should you have inquiries regarding the specific retention period of your data, you may contact our Privacy team with the contact details provided at the end of this Privacy Notice.

You are entitled to the following rights: A. Right to be informed - You have the right to be informed that your personal data shall be, are being, or have been processed. B. Right to access - You have the right to gain reasonable access to your personal data, upon demand. You may request access to the following: 1. Contents of your personal data that were processed; 2. Sources from which your personal data were obtained; 3. Purposes of processing; 4. Names and addresses of the recipients of your data; 5. Manner by which your data were processed; 6. Reasons for the disclosure of your personal data to recipients; 7. Information on automated processes where the data will or likely to be made as to the sole basis for any decision which would significantly affect you; 8. Date when your data was last accessed and modified; 9. Period for which particular categories of information will be stored; and 10. The designation, or name and address of the Company’s data protection officer. C. Right to object - You have the right to object to the processing of your personal data where such is based on consent or legitimate interest. This includes your right to object to the processing of your personal data for direct marketing, automated processing, or profiling. You likewise have the right to be notified and be given an opportunity to withhold consent to the processing in case of changes to the information given to you regarding the processing of your information. D. Right to erasure or blocking - You have the right to request for the suspension, withdrawal, blocking, removal or destruction of your personal data from our system. You may exercise this right upon discovery and substantial proof of any of the following: 1. Your personal data is incomplete, outdated, false, or unlawfully obtained; 2. It is being used for purposes you did not authorize; 3. The data is no longer necessary for the purposes for which they were collected; 4. You decided to withdraw consent, or you object to its processing, and there is no overriding legal ground for its processing; 5. The data concerns personal information prejudicial to the data subject — unless justified by freedom of speech, of expression, or of the press; or otherwise authorized; 6. The processing is unlawful; or 7. The Company violated your rights as a data subject. E. Right to damages - You may claim compensation if you suffered damages due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, considering any violation of your rights and freedoms as the data subject. F. Right to file a complaint – You have the right to file a complaint with the NPC if your data privacy has been violated. G. Right to rectification - You have the right to dispute any inaccuracy or error in your personal data and have the Company correct it within a reasonable period of time, unless the request is vexatious or unreasonable. H. Right to data portability - Where your personal information is processed by electronic means and in a structured and commonly used format, you have the right to obtain from the Company a copy of your personal data. You may also exercise this right when the processing of your personal data is based on consent or contract.

You can withdraw your consent, provided that you submit a written notice. However, depending on the circumstances and nature or extent, the withdrawal of consent may result in our inability to provide services to you. Any legal effect created before your consent is withdrawn shall stand, and shall not be affected by your withdrawal.

EO-Executive Optical reserves the right to update and revise this Data Privacy Notice at any time to align with our policies and procedures, and the data privacy laws. Prior versions of the privacy notice will be kept by the Company, and may be provided upon proper request.

For questions, comments, or concerns regarding this Privacy Notice, or our use of your personal information, you may contact us through: Data Protection Officer E-mail: dpo@eo-executiveoptical.com 11th Floor, One Oculus Center, 2120 Don Chino Roves Avenue, Barangay Pio Del Pilar, Makati City, Philippines 6th Floor, Cedar Executive Building II, 26 Timog Avenue corner Scout Tobias Street, Barangay Laging Handa, Quezon City, Philippines EO Executive Optical Privacy Policy Version 1.