Privacy and Personal Data Protection Notice

1. Introduction

Magellan E-Support Services, Inc. (“Magellan,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy and Personal Data Protection Notice explains how Magellan collects, uses, stores, discloses, retains, and protects personal data when you:

• Visit our website;
• Submit an inquiry or request through our website;
• Communicate with us regarding our services;
• Request a proposal, quotation, consultation, or other business information;
• Subscribe to or agree to receive marketing communications; or
• Otherwise interact with Magellan through its public-facing digital channels.

This notice applies primarily to website visitors, prospective clients, client representatives, business contacts, vendors, partners, and other individuals whose personal data Magellan processes through its website for its own purposes.

A separate privacy notice may apply to job applicants, employees, contractors, and individuals whose information is processed by Magellan on behalf of a client.

2. Personal Information Controller

For personal data collected through this website for Magellan’s own purposes, the Personal Information Controller is:

Magellan E-Support Services, Inc. PB Mezzanine Summit One Tower, 530 Shaw Blvd, Mandaluyong City, 1552 Metro Manila

For questions, concerns, complaints, or requests relating to your personal data, you may contact:

Data Protection Officer Email: da************@****************ns.com Telephone: 63283966000

3. Personal Data We May Collect

Magellan collects only personal data that are adequate, relevant, necessary, and not excessive for the purpose for which they are collected.

Depending on how you interact with us, we may collect the following:

3.1 Information You Provide

This may include:

• Your name;
• Email address;
• Telephone or mobile number;
• Company or organization;
• Position or job title;
• Country or location;
• Services in which you are interested;
• Preferred date or method of contact;
• Information contained in your inquiry, request, or message;
• Records of your communications with Magellan;
• Your marketing communication preferences; and
• Other information that you voluntarily provide.

The specific information collected will depend on the fields contained in the relevant website form or the information you provide through email, telephone, or another authorized communication channel.

Please do not submit sensitive personal information or privileged information through a general website inquiry form unless Magellan specifically requests it through an approved and secure process.

3.2 Technical Information

Our website hosting, security, or technical infrastructure may automatically record limited technical information necessary to operate, secure, maintain, and troubleshoot the website.

This may include:

• Internet Protocol address;
• Browser type;
• Device type;
• Operating system;
• Date and time of access;
• Pages or resources requested;
• Referring website; and
• Website security or system-event information.

Such information is used only for legitimate operational, technical, and information-security purposes.

4. Cookies and Tracking Technologies

Magellan does not use cookies or similar technologies to track website visitors for advertising, marketing, profiling, or analytics purposes.

If Magellan introduces cookies or similar tracking technologies in the future, this Privacy and Personal Data Protection Notice will be updated before or when such technologies are implemented, and appropriate consent mechanisms will be provided where required.

5. Purposes of Processing

Magellan may process your personal data for the following purposes:

5.1 To Respond to Your Inquiry

We may use your personal data to:

• Respond to questions or requests;
• Provide information about Magellan’s services;
• Arrange meetings, consultations, or demonstrations;
• Understand your organization’s requirements;
• Prepare proposals, quotations, or service recommendations;
• Conduct follow-up communications; and
• Manage a potential or existing business relationship.

5.2 To Conduct Business and Pre-Contractual Activities

We may process your information to:

• Evaluate a potential business engagement;
• Verify business or contact information;
• Conduct necessary due diligence;
• Prepare or negotiate contracts;
• Establish client, supplier, or partner relationships; and
• Perform activities requested by you before entering into an agreement.

5.3 To Maintain and Secure the Website

We may process technical information to:

• Operate and maintain the website;
• Detect and prevent unauthorized access, misuse, fraud, or security threats;
• Investigate technical errors or incidents;
• Maintain website availability and integrity; and
• Comply with information-security requirements.

5.4 To Send Marketing Communications

Where you have provided valid consent, Magellan may use your contact information to send:

• Service updates;
• Promotional information;
• Business announcements;
• Invitations;
• Newsletters; and
• Other marketing communications.

Providing marketing consent is optional. Refusing or withdrawing marketing consent will not prevent Magellan from responding to an inquiry or providing a service that you have requested.

5.5 To Comply With Legal and Contractual Requirements

We may process personal data to:

• Comply with applicable laws, regulations, court orders, and lawful government requests;
• Fulfil contractual commitments;
• Maintain legally required business records;
• Conduct audits and compliance reviews;
• Investigate suspected misconduct, fraud, or security incidents;
• Establish, exercise, or defend legal claims; and
• Protect the rights, property, security, and legitimate interests of Magellan and other persons.

6. Lawful Bases for Processing

Depending on the purpose and circumstances, Magellan may process personal data based on one or more of the following:

• Your consent;
• The performance of a contract;
• Steps taken at your request before entering into a contract;
• Compliance with a legal obligation;
• Protection of vital interests;
• Public order or safety, where applicable;
• Magellan’s legitimate interests, provided that your rights and interests are appropriately considered; or
• Another lawful basis recognized under applicable privacy laws.

Where consent is the applicable lawful basis, Magellan will request consent in a clear and specific manner.

Consent will not be bundled with unrelated terms, obtained through a pre-selected option, or made a condition of a service where the processing is unnecessary for that service.

You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing performed before the withdrawal.

7. Disclosure and Recipients of Personal Data

Magellan limits the disclosure of personal data to authorized recipients who require the information for a legitimate and approved purpose.

Your personal data may be disclosed or made accessible to:

• Authorized Magellan personnel;
• Business Development and Marketing;
• Operations and client-services personnel;
• Information Technology and Information Security;
• Compliance and the Data Protection Officer;
• Finance, Legal, and other relevant support functions;
• Approved website, hosting, communication, cloud, or technology service providers;
• Professional advisers, auditors, insurers, and retained legal counsel;
• Government agencies, regulators, courts, or law-enforcement authorities where required by law; and
• Other parties where you have provided consent or where another lawful basis applies.

Before a service provider is granted access to personal data, Magellan will conduct appropriate privacy and security due diligence and establish suitable contractual, confidentiality, and security requirements.

Magellan does not permit a service provider to process personal data for an unrelated or unauthorized purpose.

8. Cross-Border Processing

Where personal data are transferred outside the Philippines or accessed from another jurisdiction, Magellan will ensure that the processing is:

• Supported by an applicable lawful basis;
• Evaluated through Magellan’s privacy review process;
• Covered by appropriate written agreements;
• Limited to the declared purpose; and
• Protected through appropriate legal, contractual, organizational, and technical safeguards.

Magellan will take reasonable steps to ensure that cross-border processing does not reduce the protection required under applicable law, contractual commitments, and Magellan’s privacy requirements.

Before publication, Magellan should confirm whether any website, email, cloud, hosting, or communication provider processes website-submitted data outside the Philippines.

9. Data Retention

Magellan retains personal data only for as long as necessary to fulfil the purpose for which they were collected.

The applicable retention period or criteria may depend on:

• The time needed to respond to and resolve an inquiry;
• The duration of a prospective or existing business relationship;
• Contractual requirements;
• Legal, regulatory, audit, or reporting obligations;
• The need to establish, exercise, or defend legal claims;
• Security and incident-investigation requirements;
• Whether valid marketing consent remains in effect; and
• Magellan’s approved records-retention requirements.

Where an inquiry does not result in a business relationship, the information will be retained only for the period reasonably necessary to complete follow-up actions, maintain required business records, or address applicable legal and compliance requirements.

Where marketing processing is based on consent, contact information may be retained until:

• Consent is withdrawn;
• The individual unsubscribes;
• The information is no longer required for the declared purpose; or
• The applicable retention period expires.

Personal data that are no longer required will be securely deleted, anonymized, or disposed of in accordance with approved procedures, unless continued retention is legally or contractually required.

10. Accuracy of Personal Data

Magellan takes reasonable steps to maintain personal data that are accurate, complete, relevant, and current where accuracy is necessary for the processing purpose.

You may contact Magellan if you believe that your personal data are inaccurate, incomplete, or outdated.

11. Security of Personal Data

Magellan implements reasonable and appropriate administrative, organizational, physical, and technical safeguards proportionate to:

• The nature and sensitivity of the personal data;
• The purpose of the processing;
• The identified privacy and security risks;
• The size and complexity of Magellan’s operations;
• Applicable legal and contractual requirements; and
• Relevant industry practices.

Safeguards may include:

• Access controls;
• Least-privilege and need-to-know restrictions;
• Authentication controls;
• Encryption or equivalent protections, where appropriate;
• Secure configurations;
• Endpoint, network, and infrastructure security;
• Logging and security monitoring;
• Vulnerability management;
• Secure transmission and storage;
• Confidentiality obligations;
• Privacy and information-security training;
• Supplier and service-provider controls;
• Backup and recovery measures;
• Physical security; and
• Incident-response procedures.

No method of electronic transmission or storage is completely free from risk. Magellan continually reviews and improves its safeguards based on changes in risks, technology, legal requirements, and business operations.

12. Your Data-Subject Rights

Subject to applicable law and lawful limitations, you may exercise the following rights:

• Right to be informed about the processing of your personal data;
• Right to access personal data held about you;
• Right to object to certain processing;
• Right to rectification of inaccurate, incomplete, or outdated personal data;
• Right to erasure or blocking where the applicable legal conditions are met;
• Right to data portability where applicable;
• Right to withdraw consent where processing is based on consent;
• Right to file a complaint with the National Privacy Commission;
• Right to damages where legally applicable; and
• Other rights recognized under applicable privacy laws.

13. Exercising Your Rights

To exercise your rights or submit a privacy question, complaint, or concern, contact Magellan’s Data Protection Officer using the contact details provided in Section 2.

Your request should contain sufficient information to enable Magellan to:

• Understand the nature of the request;
• Identify the relevant personal data or processing activity;
• Verify your identity;
• Confirm your authority where you are acting for another individual; and
• Protect personal data from unauthorized disclosure.

Magellan may request additional information where reasonably necessary to verify your identity or clarify your request.

Requests will be logged, assessed, documented, and responded to in accordance with applicable legal, contractual, and operational requirements.

Magellan will not deny, delay, or restrict a valid request without a documented lawful basis.

You may also file a complaint with the National Privacy Commission.

14. Personal Data Processed for Clients

Magellan provides business process outsourcing, customer-support, back-office, technology, and other outsourced services.

Where Magellan processes personal data solely on behalf of and under the documented instructions of a client, Magellan acts as a Personal Information Processor.

In such cases:

• The client generally acts as the Personal Information Controller;
• The client determines the purpose and means of processing;
• The client’s privacy notice ordinarily applies to the processing;
• Magellan processes the personal data only in accordance with the client’s documented instructions and applicable agreement; and
• Requests concerning client-controlled personal data may be referred to the relevant client.

Magellan does not use client-controlled personal data for its own independent marketing, analytics, product-development, or artificial-intelligence model-training purposes unless expressly authorized, supported by an applicable lawful basis, and approved through Magellan’s privacy-review process.

15. Personal Data Breaches

Magellan maintains procedures for detecting, recording, containing, investigating, assessing, and responding to suspected or actual privacy incidents and personal data breaches.

Where notification is required, Magellan will notify the appropriate parties, which may include:

• The National Privacy Commission;
• Affected data subjects;
• Relevant clients;
• Regulators;
• Insurers;
• Law-enforcement authorities; or
• Other appropriate parties.

Notifications will be made in accordance with applicable legal and contractual requirements.

16. Third-Party Websites

The Magellan website may contain links to websites or services operated by other organizations.

Magellan is not responsible for the privacy practices, content, or security of an independent third-party website. You should review the relevant third party’s privacy notice before providing personal data through its website or service.

17. Automated Decision-Making and Profiling

Magellan does not use personal data collected through general website inquiries for solely automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Should Magellan introduce such processing in the future, this Privacy and Personal Data Protection Notice will be updated, and affected individuals will be provided with the information required under applicable law.

18. Changes to This Notice

Magellan may update this Privacy and Personal Data Protection Notice to reflect changes in:

• Applicable laws or regulatory requirements;
• Website functions;
• Business activities;
• Service providers;
• Systems and technologies;
• Personal-data processing practices; or
• Privacy and information-security controls.

The updated notice will be published on this page with a revised “Last Updated” date.

Where a change materially affects the processing of personal data, Magellan will provide additional notice or obtain consent where required.

19. Contact Information

For privacy questions, concerns, complaints, or requests, please contact:

Compliance Department

Magellan E-Support Services, Inc.

Email: da************@****************ns.com

Telephone: 63283966000

Address: PB Mezzanine Summit One Tower, 530 Shaw Blvd. Mandaluyong City Metro Manila