GCash for Business
‍Privacy Notice

We keep your personal data for at least five (5) years after the last transaction you made using the Platform or after you close your account. We will keep this information for as long as we are required by anti-money laundering requirements, for compliance with Bangko Sentral ng Pilipinas regulations, and for other legal obligations.

‍

If your information is relevant to an investigation, legal case, complaint, claim, or court order, we may keep the information for up to ten (10) years after the matter is completed or resolved, or for as long as the law or a court order requires.

1. Direct interactions: We collect information when you register to use the Platform and provide personal data to onboard authorized users, use our services, contact us for assistance, and other direct interactions. We also collect information when you directly contact us through email, phone, chat, or other support channels.

2. Authorized user nominations: We collect your personal data when an enterprise or its administrator nominates or assigns individuals as authorized users and submits their information to assign platform roles.
   
   
3. From Third Parties: We may also receive data from our partners, such as your employer, bank, biller, merchant, or product provider, when allowed by law, needed for the service you choose, or based on your instruction or consent.
   
   We may receive your personal data when you ask another company to transact with us, share data with us, or send or port your data to us. Porting means sending a copy of your data from one company to another based on your request or instruction. 
   

We securely share your personal data to trusted partners, service providers, financial institutions, and government agencies only when allowed by law, needed for a service, explained in the relevant terms or notice, or based on your instruction or consent where needed.
‍

1. GXI Affiliates: Different companies affiliated with GXI work together to support or provide the various services offered by GCash, which includes the G4B Platform. This includes Mynt, Inc. (“Mynt”, formerly Globe Fintech Innovations, Inc.), which is the parent company of GXI, Fuse Financing Inc. (“Fuse”), Ryse, Inc. (“Ryse”), BlockG Virtual Assets, Inc. (“BlockG”), Electronic Commerce Philippines Inc. (“ECPay”), and other Mynt-subsidiaries or Mynt-affiliated companies named in this Privacy Notice or in service-specific terms.
   ‍
2. ‍Financial institutions and crime prevention partners: We may share your personal data with fraud and crime prevention partners, financial institutions, participating payment processors, clearinghouses, settlement banks, and other allowed parties to confirm your identity, manage risks, comply with the law, and help protect you, other users, and the Platform from fraud, scams, money laundering, and other crimes.
   ‍‍
3. Partners: To offer you a broad range of financial services, we collaborate with banks, billers, merchants, and other partners. For example, when you use your corporate wallet to pay your bills, we may share your personal information with the biller, in order to facilitate your transaction.
   
   When you choose these services, we may share, send, or port your personal data to the partner only when allowed by law, needed for the service you choose, covered by the relevant terms or privacy notice, or based on your instruction or consent. When required, we will show you the relevant notice, consent screen, data porting screen, or service terms in the app. These partners may also have their own terms and privacy notices explaining how they use your personal data for their services.
   
   Whenever you avail a product or service which requires sending your KYC information to a third-party, we’ll let you know in the app and make sure we have your explicit instruction to port your data. (See GCash Porting Terms and Conditions)
   ‍‍
4. Service Providers: We may share your personal data with trusted service providers who help us operate the G4B Platform. They help us answer your questions, analyze and verify information, manage risk, prevent fraud, process payments, store data, provide cloud services, and keep accounts secure.  
   
   Our service providers may process your personal data only for the purposes we allow. They are required by contract to protect your data, keep it confidential, and follow our security requirements. Some of our service providers may store or process data outside the Philippines. When this happens, we use safeguards required by law. 
   
   For security reasons, we may not publish the full list of our service providers. As a data subject, you may request more information on how we process your data. Please see the “How can you exercise your data privacy rights?” section of this Privacy Notice.
   ‍‍
5. Law enforcement agencies, regulatory bodies, local government units, and courts: We may share your personal data with law enforcement agencies, regulators, local government units, courts, and other public authorities when required by law, when needed to protect our rights, or when needed to prevent fraud, crime, or harm to our Platform users and the public. These may include the Anti-Money Laundering Council, the Bangko Sentral ng Pilipinas, the Credit Information Corporation, the National Bureau of Investigation, the Philippine National Police, courts, and other similar authorities.
   ‍
6. Changes in our business: If GXI or any part of our business is merged, sold, reorganized, or transferred to another company, we may need to share or transfer personal data as part of that change.  This may include sharing limited personal data with potential or actual buyers, investors, or professional advisors when needed to review, negotiate, or complete the change, subject to appropriate confidentiality and security safeguards. If this happens, we will tell you when required by law and explain any important changes to how your personal data will be handled.

‍

We may use automated processing or decision-support tools. This means we may use computer systems, rules, models, or similar tools to help us review data, detect risks, check eligibility or suitability, improve services, personalize your experience, or protect your account.
‍

These tools may use personal data such as:

• information you give us when you sign up, such as KYC and basic profile information;
• information from your use of the Platform and services, such as financial and transaction records and platform usage data;
• information we receive from authorities, partners, or other allowed sources, such as fraud, crime prevention, or security information; and
• inferred or derived information, such as risk flags, eligibility flags, preference indicators, or customer segments.

‍

We may use these tools to assess whether you may be eligible or suitable for certain offers or services, such as promos, rewards, or other financial products. We may also use them to prevent fraud, protect users, comply with legal rules, and improve our products and services.

‍

Where automated processing is the sole basis for a decision that may significantly affect you, we will provide the notice, rights, and safeguards required by law.

GXI may use artificial intelligence or machine learning, also called AI/ML, to help improve our products and protect our users.
‍

We may use AI/ML for the following purposes:

• Protection and security: We may use AI/ML to detect scams, unauthorized access, suspicious activity, fraud, and money laundering risks. These tools help us protect users, block harmful activity, and comply with legal and regulatory rules. Because this processing is needed for safety and compliance, it cannot be turned off.
• Efficiency and experience: We may use AI/ML tools, such as automated assistants, to answer questions faster, improve customer support, and reduce errors. We will tell you when you are directly interacting with an AI system, where required or appropriate. ‍
• Eligibility, suitability, and transaction patterns: We may use AI/ML to help understand transaction patterns, service use, and risk or eligibility signals. This helps us check whether certain products or services may be relevant, suitable, or available to you. ‍
• Model training and improvement: We may use data to train, test, and improve our AI/ML models. This may include transaction indicators, platform activity, service-use patterns, feedback, preferences, and other data explained in this Privacy Notice. Where possible, we use aggregated, de-identified, minimized, or synthetic data. We also review our models to help keep them accurate, secure, and fair, and to reduce errors or unfair bias.
  
  

We design and review our AI/ML use to support transparency, security, fairness, accountability, and privacy. Where practical, we use safeguards such as access controls, testing, monitoring, human review, and privacy-enhancing techniques. These may include using aggregated, de-identified, minimized, or synthetic data to reduce privacy risk.

Your trust and privacy are important to us. We use safeguards to help keep your personal data safe when it is collected, used, shared, stored, or sent.

‍

There can be risks when you create a profile or use a digital platform. Someone may try to take control of your account (account takeover), trick you into giving away your personal data (social engineering), or access your phone without your permission (hacking). We use security measures to help protect your data from loss, misuse, unauthorized access, or other harmful activity.

These security measures include:

‍

• Restricting access: Only authorized people, systems, or companies may access your personal data when they need it for an allowed purpose.
• ‍Encryption: We use encryption to help protect your personal data when it is stored or sent. Encryption turns information into a secret code that can only be read by someone with the right key.
• ‍Multi-factor authentication (MFA): We use MFA in the G4B Platform. This means you may need more than one step before you can access your account or use certain features. For example, to access your account, we may send a one time password (OTP) to your registered email. 

We also check how data moves into and out of our systems to help keep it protected. We use organizational, physical, and technical security measures aligned with recognized industry standards.

‍

When service providers or partners process personal data in connection with your G4B Platform account or a GXI product or service, we require them to protect your data and follow our privacy and security requirements. GXI affiliates must also follow the security and privacy rules that apply to their services and data use.

‍

You also play an important role in keeping your account safe. Never share your MPIN or OTP. Tell us right away if you think your account, password, MPIN, or OTP has been compromised. For more information on protecting your G4B Platform Account, visit the Help Center.

‍

We may also use privacy-enhancing technologies or PETs. These are tools that help us improve our services while reducing the use of real personal data. For example, we may use synthetic data. Synthetic data is sample data made by computer systems. It can show patterns similar to real customer data, but it does not contain actual personal data. This helps us test systems, study trends, and build new features with less privacy risk. We use PETs where practical and appropriate. Not all data processing can be done this way, but we use these tools when they help protect your privacy and keep your data safe.

You have rights under the law. These rights may be subject to legal limits. For example, we may need to keep some data to follow the law, prevent fraud, protect users, or resolve disputes. Your rights include:

‍

1. Right to be informed: You can be told how we collect, use, share, keep, and protect your personal data.
2. Right to access: You can ask for a copy of the personal data we have about you.
3. Right to rectify: You can ask us to correct mistakes or errors in your personal data.
4. Right to object: You can object to certain uses of your personal data, such as processing based on consent or legitimate interest, when allowed by law.
5. Right to withdraw consent: If we rely on your consent to process your personal data, you can withdraw your consent. This will not affect processing done before you withdrew consent, or processing we must continue under law or for a service you requested.
6. Right to erasure or blocking: You can ask us to delete, block, or stop using your personal data when allowed by law.
7. Right to data portability: You can ask for a copy of your personal data in an electronic format. You may also ask us to port or send your data to another company when allowed by law.
8. Right to file a complaint: You can file a complaint with the National Privacy Commission if you believe your privacy rights were violated.
9. Right to damages: You may claim compensation if your privacy rights were violated and you suffered damage.

‍For more information about your privacy rights, you can visit the National Privacy Commission’s website to look at resources about the Rights of Data Subjects.

‍

We will handle your requests to access, rectify, delete, block, object to, or port your personal data, unless legal reasons prevent us from doing so.

‍

Before acting on your request, we may ask you to verify your identity. This helps us make sure we are dealing with the right person and protects your account from unauthorized requests.

‍

If your request relates to a service handled by a specific Mynt Group company other than GXI, we may coordinate with that company or direct your request to the proper channel.

‍

To learn more about managing your personal data, you may visit our Help Center or call us at 2882 through Customer Care.

‍

We update this Privacy Notice from time to time. We do this to keep you informed about how we protect and use your personal data, and to reflect changes in our services, privacy practices, security measures, or legal requirements.

‍

We recommend that you visit this page regularly to stay informed of any updates.

‍

Effective Date: 22 July 2026