PRIVACY NOTICE: GLOBE CLOUD

At Globe Telecom, Inc. ("Globe"), we are committed to protecting your personal data and your privacy. This Globe Cloud Privacy Notice explains how your personal data is collected, used, and shared when you use the Globe Cloud service (the "Service").

This Service is provided by Globe in partnership with our technical infrastructure provider, Synchronoss Software Ireland Limited and its affiliates (collectively, "Synchronoss").

This Privacy Notice ("Notice") is a service-specific supplement to the Globe Privacy Policy. It governs the processing of personal data within the Globe Cloud Service ("Service") and is issued by "Globe", acting as the Personal Information Controller (PIC) under the Philippine Data Privacy Act of 2012 (RA 10173).

1. RELATIONSHIP TO GLOBE GROUP PRIVACY POLICY

This Notice supplements Globe's Privacy Policy. For general information regarding how Globe handles your data, your comprehensive rights as a data subject, and our global security standards, please refer to Globe's Privacy Policy at https://www.globe.com.ph/privacy-policy. In the event of any conflict between this Notice and the Globe's Privacy Policy regarding this Service, the provisions of this Notice shall prevail.

2. ROLES AND PARTNERSHIPS

• Data Controller: Globe is the PIC and determines the purposes of processing.
• Data Processor: Synchronoss Technologies, Inc. (and its affiliates) acts as the Personal Information Processor (PIP), handling data strictly according to Globe's instructions.
• Sub-Processors: We utilize Amazon Web Services (AWS) for secure cloud infrastructure and Google for integrated analytics and mapping features.

3. DATA COLLECTION AND PURPOSES OF PROCESSING

To provide the Service, we collect and process the following categories of personal data:

• Identity and Account Information: Your first and last name, email address, mobile number (MSISDN), Globe customer identifier, and any PIN codes you create for secure features (e.g., Private Folder).
• User Content: All digital files you choose to upload, including photos, videos, music, documents, and contacts, as well as the names of those files.
• Technical and Usage Data: Your IP address, device type, device ID, device serial number, and service log data (e.g., activation status, login/logout times, and app usage analytics).
• Location Information: Your general location and specific geographic data (GPS coordinates) contained within the metadata (EXIF tags) of your uploaded photos and videos.
• Biometric and Facial Recognition Data: To enable features like automated photo tagging and "Memories," the Service processes your images to detect and compare faces. This results in the creation of facial templates to group photos of the same person together.
• Communications Data: Information you provide when contacting Globe for technical support or customer service regarding the Cloud app.

Globe processes your data for the following essential purposes:

• Core Service Delivery: Facilitating storage, backup, and synchronization across devices.
• Feature Optimization & AI: Utilizing machine learning and Artificial Intelligence (AI) for automated photo tagging, facial recognition, "Memories," "Flashbacks," and "Genius" image enhancement.
• Metadata Analysis: Collection of EXIF data (geographic tags), timestamps, device identifiers, and file types to enable smart-sorting and location-based features.
• Operational Requirements: Account authentication, billing, and technical support.
• Safety & Compliance: Mandatory automated screening for Child Sexual Abuse Material (CSAM) and prevention of security breaches.

4. DATA RETENTION AND DISPOSAL

We retain your personal data and content only for as long as it is necessary to provide you with the Service.

• Active Accounts: We store your files and account information for as long as your Globe Cloud subscription remains active.
• Account Closure: If you choose to delete your account or cancel your subscription, we will initiate the deletion of your data.
• Legal Compliance: In certain cases, we may be required by Philippine law or legal proceedings to keep specific records for a longer period, even after you stop using the Service.

When your data is no longer needed or if you request its deletion, we follow a strict destruction process to ensure it cannot be recovered:

• Permanent Purging: Electronic records are wiped, overwritten, or permanently deleted from our systems and the systems of our technical partners (such as Synchronoss and AWS).
• Irretrievability: Once the disposal process is complete, your files are rendered irretrievable. For your protection, we recommend exporting your photos, videos, music, documents, and contacts before closing your account.
• Physical Records: Any physical documents containing your personal information are destroyed through secure shredding.
• Timeline: We complete the deletion process without undue delay, typically within thirty (30) days of your account termination or valid deletion request.

5. INTERNATIONAL DATA TRANSFERS AND RESIDENCY

To ensure service redundancy and high availability, you expressly consent to the transfer, storage, and processing of your personal data and Content in secure data centers located in the United States, Ireland (EEA), United Kingdom, France, and India.

6. SECURITY AND CERTIFICATIONS

• Standards: Our PIP maintains ISO/IEC 27001 and SOC 2 Type II certifications.
• Encryption: Data is encrypted both at rest and in transit using industry-standard protocols.
• Breach Protocol: Our processors must notify Globe of any actual or reasonably suspected Personal Data Breach involving Client Personal Data within twenty-four (24) hours from knowledge or discovery thereof, and must also promptly report any Security Incident affecting the confidentiality, integrity, or availability of Client information or information systems, in accordance with the incident management and notification procedures under the Data Processing Agreement. Globe will notify the National Privacy Commission (NPC) and affected subjects, as warranted, within the 72-hour window required by RA 10173.

7. PROHIBITED DATA TYPES

The Service is not licensed for, and Globe assumes no liability for, the storage of:

• (a) Credit Card Data (PCI information);
• (b) Protected Health Information (medical records).

8. HOW TO REACH US

Should you wish to exercise any of your data subject rights or have any questions or concerns regarding our privacy practices, you may contact our Data Protection Officer: