Transparency Notice

We value your privacy

We at Isla Lipana & Co./PwC Philippines are committed to protecting your privacy and complying with the Data Privacy Act of 2012 and its Implementing Rules and Regulations. This notice explains how we collect, use, store, and protect personal information when you interact with us through our public website and related online interactions.

For these activities, we generally act as a Personal Information Controller (determining the purpose and manner of processing), and in certain cases may act as a Personal Information Processor, including when processing information on behalf of another PwC firm or client, subject to appropriate contractual arrangements.

What information do we collect about you?

The Firm will collect all personal information and data, including sensitive personal information depending on how you interact with us (e.g., as a website visitor, business contact, applicant, supplier, or personnel) We may collect:

• identity and contact details;
• professional and business information;
• records and documents you submit to the Firm;
• messages, inquiries, and requests you send us; and
• online and technical information generated when you use our website (e.g., IP address, device and browser details, logs, cookies, and website security tools).

We do not intentionally collect sensitive personal information through the website unless you choose to provide it.

Some cookies may be set by third-party providers to help us operate the website and understand how it is used. For more information on cookies and similar tools, please refer to our cookie information.

What we collect and why we use it

When we collect information, it shall be in connection with the relationship that you have with the Firm (e.g., prospective employment, employment, internship, consultancy, contractual) or any business/professional interest that you may have with us (e.g., firm visits, trainings and seminars, social events and programs).
We collect and use personal information to manage our relationship with you and to operate our services responsibly and securely. Where required by law, we rely on your consent as the lawful basis for processing your personal information. Consent is obtained through clear and affirmative actions, such as submitting online forms or accepting non-essential cookies.

You may withdraw your consent at any time by contacting our Data Protection Officer. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

Summary of processing activities for this site

How do we collect information about you?

We usually collect personal information (and, where applicable, sensitive personal information) directly from you. In some cases, we may also collect relevant information from other sources, including when information is collected on our behalf by service providers or other parties outside the PwC network. Where appropriate, we will inform you when this applies.

By providing your information, you confirm that we may collect and verify related information from other sources for the purposes described in this notice, unless you advise us otherwise.

How do we use your information?

When we use your information, we limit our use to what is lawful and necessary to the relationship that you have with us.

Our legitimate interests in our relationship with you and our business provide a lawful basis for us to use your information in the ways agreed with you. We may also process your information to further our legitimate interests in our broader business purpose, which is to build trust in society and solve important problems. Where we process based on our legitimate interests, we’ll do so only to the extent our interests do not override your fundamental rights and freedoms which require your personal information and sensitive personal information to be protected.

It’s essential to our business that we comply with all our legal and professional obligations and also with our obligations as a member of the PwC network. Other PwC firms must do the same. That means we use your information to the extent necessary in connection with compliance (by us or another PwC firm) with obligations under:

• the PwC network’s regulations, standards and policies, including the PwC Network Information Security Policy and PwC Network Data Protection Policy; and
• applicable laws and professional rules, including your compliance with your obligations under applicable laws and professional rules, where relevant to your employment relationship, including your business relationship with another PwC firm (e.g. where we provide services to another PwC firm and you’re involved in providing those services on our behalf).

As a technology-enabled firm, our IT systems and applications—and keeping them secure and up to date—are key to our business. That means we use your information to the extent necessary to operate, administer, manage, improve, and analyze performance and use of the IT systems and applications we or any other PwC firm uses. This includes monitoring the use of those systems and applications for security purposes and for any compliance purposes referred to above.

How do we transfer and store information about you?

Transfers within the PwC network

PwC is a global network. Information about you may be transferred and disclosed to other PwC firms and affiliate firms for specific and legitimate business, professional, employment, and compliance-related purposes consistent with this Notice and applicable laws. For a list of countries where PwC firms are located, please see www.pwc.com/gx/en/about/office-locations.html

Cross-border transfers of personal information are carried out in accordance with applicable data protection laws and subject to appropriate safeguards, which may include data-sharing agreements, confidentiality obligations, and PwC network-wide data protection and information security policies, to maintain protections consistent with Philippine data protection requirements.

Processing locations and transfers to third-party service providers

PwC firms use servers and other resources in various countries to process personal information. We may also share personal information with third-party service providers that support our operations, such as website hosting, identity management, analytics, backup, security, and storage. Where applicable, these service providers are subject to vendor due diligence and contractual safeguards and are required to protect personal information, maintain confidentiality, and process personal information only in accordance with our instructions.

Other disclosures required or permitted by law

We or other PwC firms may disclose information about you to law enforcement, regulatory and other government agencies, and to professional bodies and other third parties, as required by and/or in accordance with applicable laws and/or regulations. This includes disclosures outside the country you are in. PwC firms may also review and use your information to determine whether disclosure is required or permitted.

We store personal information in secure systems and controlled locations where access is limited to authorized personnel on a need-to-know basis. Appropriate safeguards apply regardless of where the information is stored.

How long will we keep information about you?

We keep personal information only for as long as necessary to fulfil the purpose for which it was collected or as required or permitted by applicable laws and regulations. As a general rule, we retain personal information for a maximum of ten (10) years from the date of last activity or from separation, as applicable, unless a longer retention period is required or permitted by law. Where personal information is subject to a legal hold, it will be retained until the hold is formally lifted or the matter is concluded.

How do we protect your information?

We have implemented generally accepted standards of technology and operational security in order to protect personal information from loss, misuse, alteration, or destruction. Only authorized persons are provided access to personal information. Such individuals have agreed to maintain the confidentiality of this information.

While we implement appropriate security measures on the personal data we have collected, the security of the transmission of these data over the internet cannot be fully ensured. We endeavor to protect personal data, but we cannot guarantee the security of data transmitted to or by us. For further details on our security standards and controls, you can read our PwC Information Security Statement.

Disposal and destruction

When personal information is no longer required, we dispose of it securely to prevent unauthorized access, disclosure, or further processing. This may include secure and permanent deletion for electronic records and secure shredding or destruction for physical records, as applicable.

Your rights

To exercise your data subject rights, please submit a request through our Privacy Web Form.

Subject to applicable laws, you have the right to:

• be informed about the processing of your personal information;
• access personal information we hold about you;
• object to the processing of your personal information;
• request correction or rectification of inaccurate or incomplete information;
• request erasure or blocking of personal information under certain circumstances;
• withdraw consent where processing is based on consent;
• data portability, where applicable;
• lodge a complaint with the National Privacy Commission; and
• be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information.

Need further information?

If you have questions or feedback on this notice, please contact us using the details below.

Data Protection Officer
Isla Lipana & Co.
29/F AIA Tower
8767 Paseo de Roxas 1226
Makati City, Philippines
T: +63 (2) 845 2728 | F: +63 (2) 845 2806

ph_dpo_islalipana@pwc.com

_{Last updated: 30 January 2026}