Data Privacy Policy Rural Bank of Kibawe (Bukidnon), Inc.

Last Updated: March 24, 2026

 

INTRODUCTION

 

Rural Bank of Kibawe (Bukidnon), Inc. (the “Bank”, “we”, “us”, or “our”) is a rural bank duly licensed and supervised by the Bangko Sentral ng Pilipinas ("BSP") with Certificate of Authority No. B1016 and Company Registration No. 91025. The Bank's principal office is located at Sayre Highway, West Kibawe, Kibawe, Bukidnon, Philippines.

 

The Bank’s banking products and services are made accessible to users (“you” ,”your” or “User”) through the Finbubu App, a technology platform operated by Finbubu Limited, a company incorporated in Hong Kong (“Finbubu” or “Platform Operator”). Finbubu acts solely as a technology platform facilitator and does not itself provide banking or financial services. The Bank is solely and independently responsible for all banking products and services it provides through the App.

 

This Data Privacy Notice (“Notice”) explains how the Bank collects, uses, stores, shares, and protects your personal data in connection with the banking products and services you access through the Finbubu App. This Notice is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulations (“IRR”), the relevant issuances of the National Privacy Commission (“NPC”), and the applicable regulations of the Bangko Sentral ng Pilipinas (“BSP”).

 

By using the Finbubu App to access the Bank’s products and services, you acknowledge that you have read and understood this Notice and consent to the collection and processing of your personal data as described herein.

 

1. Scope of This Notice

 

This Notice applies to personal data collected and processed by the Bank in connection with the following services made available through the Finbubu App:

-Deposit products;

-Loan and credit products; and

-Related banking services.

 

This Notice is separate from and supplements the Finbubu App Privacy Policy, which governs Finbubu Limited’s own collection and processing of personal data as platform operator. Both this Notice and the Finbubu App Privacy Policy apply to your use of the App. In the event of any inconsistency between this Notice and the Finbubu App Privacy Policy with respect to the Bank's services, this Notice shall prevail.

 

2. Personal Data We Collect

 

The Bank collects the following categories of personal data:

 

2.1  Identity and Contact Information

• Full name, date of birth, gender, and civil status;
• Government-issued identification documents (e.g., passport, SSS, PhilSys ID, driver’s license, TIN);
• Residential address, email address, and mobile number;
• Specimen signature and/or biometric data (where required for account opening or identity verification).

 

2.2  Financial and Transaction Information

• Bank account details, account balance, and transaction history;
• Loan application information, credit assessment data, and repayment records;
• Income information, employment details, and other information necessary to assess creditworthiness;
• Source of funds and source of wealth declarations (as required under AML/CFT regulations).

 

2.3  Device and Technical Data (collected via the Finbubu App)

• Device model, operating system version, and unique device identifiers;
• IP address and network connectivity information;
• App usage logs and transaction timestamps.

Note: Device and technical data are collected by Finbubu Limited as platform operator. Please refer to the Finbubu App Privacy Policy for further details on the collection of such data.

 

2.4  Additional Data Required by Law

Politically exposed person (PEP) status and related declarations;

Any other information required by BSP, AMLC, or other regulatory authorities.

 

3.  Purposes of Collection and Processing

 

The Bank collects and processes your personal data for the following purposes:

 

(a)  Performance of Banking Services

• Account opening, verification, and ongoing account management;
• Processing of deposit placements, withdrawals, and fund transfers via BSP-accredited payment systems (including InstaPay and PESONet);
• Loan origination, credit assessment, disbursement, and collection;
• Responding to customer inquiries and complaints.

 

(b)  Regulatory Compliance

• Know-Your-Customer (KYC) and Customer Due Diligence (CDD) under BSP regulations and the Anti-Money Laundering Act (RA 9160, as amended);
• Transaction monitoring and suspicious activity reporting to the Anti-Money Laundering Council (AMLC);
• Compliance with BSP Memorandum Circulars, the Financial Consumer Protection Act (RA 11765), and all other applicable laws and regulations;
• Tax reporting and withholding obligations.

 

(c)  Risk Management and Fraud Prevention

• Credit risk assessment and portfolio management;
• Fraud detection, prevention, and investigation;
• Cybersecurity monitoring and incident response.

 

(d)  Service Improvement and Communication

• Analysis of service usage to improve the Bank’s products and digital banking capabilities;
• Sending transactional notices, account statements, and regulatory disclosures;
• Marketing communications regarding the Bank’s products and services, subject to your consent and the right to opt out at any time.

 

4.  Legal Bases for Processing

 

The Bank processes your personal data on the following legal bases under Section 12 of the DPA:

 

• Contractual necessity — processing is necessary to open and maintain your account and to provide the banking services you have requested;
• Legal obligation — processing is required to comply with BSP regulations, AMLA, tax laws, and other applicable Philippine laws;
• Legitimate interests — processing is necessary for the Bank's legitimate interests in fraud prevention, risk management, and service improvement, provided such interests do not override your rights;
• Consent — where required by law or regulation, the Bank will obtain your explicit consent prior to processing, including for marketing communications and certain sensitive personal information.

 

5.  Data Sharing and Disclosure

 

The Bank will not sell or rent your personal data. The Bank may share your personal data only in the following circumstances:

 

(a)  Technology Platform Operator

The Bank shares necessary data with Finbubu Limited (as platform operator) to the extent required for the technical delivery of banking services through the App, subject to strict confidentiality and data processing obligations. Finbubu Limited does not use such data for any purpose other than platform service delivery.

 

(b)  Regulatory and Government Authorities

• BSP — for supervisory examinations, regulatory reporting, and compliance verification;
• AMLC — for transaction reporting, suspicious activity reports, and covered transaction reports;
• NPC — for data breach notifications and compliance inquiries;
• BIR — for tax withholding and reporting obligations;
• Other government agencies and courts — where required by law, court order, or legal process.

 

(c)  Service Providers and Third-Party Partners

• Credit bureaus and credit information systems (e.g., CIC — Credit Information Corporation) for credit assessment and reporting;
• Payment system operators (e.g., BancNet, InstaPay, PESONet) for fund transfer processing;
• Identity verification and KYC service providers;
• IT infrastructure, cloud storage, and cybersecurity service providers;
• Legal, audit, and compliance advisers.

All third-party service providers are bound by confidentiality agreements and are required to process personal data only for the specific purposes authorized by the Bank, in compliance with the DPA.

 

(d)  With Your Consent

The Bank may share your data with other parties where you have given specific, informed consent.

 

6.  Data Security

 

The Bank implements appropriate technical, organizational, and physical security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These measures include:

 

• Encryption of data in transit and at rest using industry-standard protocols;
• Role-based access controls and authentication mechanisms;
• Regular security assessments, vulnerability testing, and system audits;
• Staff training on data privacy and information security obligations;
• Physical security measures at the Bank’s premises and systems.

 

In the event of a personal data breach that is likely to pose a real risk of serious harm to affected data subjects, the Bank will: (i) notify the BSP within two (2) hours of discovering the incident, as required under the MORB; (ii) notify the NPC within seventy-two (72) hours of becoming aware that a reportable breach has occurred, in accordance with NPC Circular No. 16-03; and (iii) notify affected data subjects without undue delay.

 

7.  Data Retention

 

The Bank retains your personal data for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws and regulations, including:

 

• A minimum of five (5) years following the closure of your account, in compliance with the Anti-Money Laundering Act (RA 9160, as amended);
• Such longer periods as may be required by BSP regulations applicable to banking records, tax obligations, or ongoing legal proceedings;
• Where the Bank needs to defend or establish legal rights in connection with any dispute or regulatory investigation.

 

Upon expiration of the applicable retention period, personal data will be securely deleted, destroyed, or anonymized in accordance with the standards prescribed by the NPC and BSP.

 

8.  Your Rights as a Data Subject

 

Under the Data Privacy Act of 2012, you have the following rights:

• Right to be informed — to be provided with clear information about how your personal data is collected and processed;
• Right to access — to obtain a copy of the personal data the Bank holds about you and information on how it has been processed;
• Right to correction — to have inaccurate or incomplete personal data corrected;
• Right to erasure or blocking — to request deletion or suspension of processing of your personal data where it is no longer necessary, was unlawfully obtained, or where you have withdrawn consent;
• Right to object — to object to processing of your personal data, including for direct marketing purposes;
• Right to data portability — to receive your personal data in a structured, commonly used format, or to have it transmitted to another data controller, where technically feasible;
• Right to damages — to claim compensation where your privacy rights have been violated;
• Right to file a complaint — to lodge a complaint with the National Privacy Commission (NPC) at https://privacy.gov.ph/

.

To exercise any of the above rights, please contact the Bank’s Data Protection Officer using the contact details in Section 11 below. The Bank will respond to your request within a reasonable period and in accordance with the DPA and NPC regulations.

 

9.  Cookies

 

The Bank’s products are accessed through the Finbubu App. Cookies and device data collection are managed by Finbubu Limited as platform operator; please refer to the Finbubu App Privacy Policy for details.

 

 

10. Data Storage Location

Your personal data collected and processed by the Bank in connection with its services through the Finbubu App is stored on cloud servers located within the Philippines. The Bank does not transfer your personal data to servers or systems outside the Philippines in the ordinary course of its operations.

 

11.  Contact Information and Data Protection Officer

 

For questions, concerns, or requests relating to this Notice or your personal data, please contact:

 

Data Protection Officer

Rural Bank of Kibawe (Bukidnon), Inc.

Address: Sayre Highway, West Kibawe, Kibawe, Bukidnon, Philippines

Email: [ compliance@finbubu.com ]

Office Hours: Monday to Friday, 8:00 AM – 5:00 PM (Philippine Standard Time), excluding public holidays.

 

12.  Updates to This Notice

 

The Bank may update this Notice from time to time to reflect changes in its practices, applicable laws, or the services offered. Any material changes will be communicated to you through the Finbubu App, the Bank’s official website, or other appropriate channels. The updated Notice will indicate the revised “Last Updated” date at the top.

 

Your continued use of the Bank’s services through the Finbubu App after the effective date of any update constitutes your acceptance of the revised Notice. If you do not agree with any changes, you may contact the Bank to discuss your options.

 

 

Acceptance

 

By registering for and using the Bank’s products through the Finbubu App, you confirm that you have read and understood this Data Privacy Notice, and you consent to the collection, use, storage, processing, and sharing of your personal data as described herein, in accordance with Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations.

 

You acknowledge that electronic records and signatures are valid, binding, and enforceable, and shall be treated as equivalent to physical documents and handwritten signatures for all purposes under Philippine law, including the Electronic Commerce Act (RA 8792). This Data Privacy Notice is issued by Rural Bank of Kibawe (Bukidnon), Inc. as a BSP-supervised financial institution. It applies specifically to personal data processed by the Bank in connection with the financial products and services accessed through the Finbubu App, and is separate from the Finbubu App Privacy Policy issued by Finbubu Limited as platform operator.