IKEA FAMILY AND SMÅLES MEMBERSHIP
PERSONAL DATA PROTECTION NOTICE

Dear valued IKEA Family members and/or guardians of småles members at IKEA,

At IKEA, we are committed to respecting and protecting the privacy rights of all our data subjects.

This IKEA Family and småles Membership Personal Data Protection Notice (“Membership Data Privacy Notice”) is issued to all our valued IKEA Family members/applicants and/or guardians of småles members/applicants of Ikano (Philippines) Inc. (“IKEA”, “us”, “we”, “our” or “ours”), pursuant to the statutory requirements of the Philippines’ Data Privacy Act of 2012 (“PDPA”).

IKEA is the Personal Information Controller (“PIC”) of the Personal Data of IKEA Family members, guardians of småles members and småles members.

This means that IKEA determines the purposes for which such Personal Data will be used. Where your and your småles members’ Personal Data is disclosed to third parties under a data sharing agreement, such third parties are also constituted as PICs.

This Membership Data Privacy Notice tells you what to expect when IKEA processes your and your småles members’ Personal Data. This Notice is incorporated into and made part of the Membership Agreement executed with you.

DEFINITION OF TERMS

Unless otherwise provided in this Membership Data Privacy Notice or the context otherwise requires, the capitalized terms herein shall have the same meaning as provided in the PDPA.

“Person” means any natural or juridical person.

“Personal Data” means all types of Personal Information including Sensitive Personal Information and Privileged Information.

“Personal Information” refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information, would directly and certainly identify an individual;

“Privileged Information” refers to any and all forms data, which under the Rules of Court and other pertinent laws constitute privileged communication;

“Processing” refers to any operation or any set of operations performed upon personal data including, but not limited to, the collection, recording, organization, storage, updating, or modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data. Processing may be performed through automated means, or manual processing, if the personal data are contained or are intended to be contained in a filing system.

“Sensitive Personal Information” refers to personal information: (1) about an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) about an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such individual, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) issued by government agencies peculiar to an individual which includes, but is not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; or (4) specifically established by an executive order or an act of Congress to be kept classified

Whenever the word “include,” “includes” or “including” are used in this Notice, they shall be deemed to be followed by the words “without limitation”.

The meaning assigned to each term used here will be equally applicable to both the singular and plural forms of such term, and the words denoting any gender shall include all genders.

TYPES OF DATA

During your and/or your småles member’s course of dealing with us, we will collect, use, disclose, store, maintain, access, process and/or transfer your and/or your småles member’s Personal Data.

Personal data which we collect and process may include Sensitive Personal Information and/or Privileged Information, including:

• Contact data such as your and/or your småles member’s name, nickname, residence address, phone or mobile number, personal email addresses, next of kin, emergency contacts and emergency contact details;
• Identity data such as your and/or your småles member’s date of birth, age, gender, citizenship/nationality;
• Financial data such as bank account and payment card details;
• Transaction information such as the item purchased from us, how such purchase was paid for, the address where the product or service was sent, membership points collected or used in relation to the transaction;
• Special Category Data such as health data or information as to the physical or mental health or condition of a data subject and religious beliefs or other beliefs of a similar nature;
• User Data such as Personal ID photos at the time of application for membership, images or footage of you and/or your småles member captured through the use of CCTVs and recorded on our systems;
• Interaction data including your shopping preferences, browsing frequency and behavior, survey or competition/promotion participation, as well as voice recordings when you use the customer service hotline;
• Technical Data such as IP address, information about your device, operating system, plug-ins, account log-in and password details, as well as location data.
• Any other Personal Data as prescribed by the law from time to time.

PURPOSES

We need to collect, use, disclose, store, maintain, access, process and/or transfer your or and/or your småles member’s Personal Data for the following purposes (collectively referred to as “Purposes”):

• to provide products and/or services to you and/or your småles member;
• to communicate and interact with you and/or your småles member and respond to your and/or your småles member’s enquiries or complaints;
• provide you and/or your småles member with information and/or updates on products, services and/or promotions offered by IKEA and selected third parties;
• identify you and/or your småles member (including publishing your name and/or your småles member’s name and photograph) when you and/or småles member become a winner(s) in a contest, competition and/or participate(s) in any events/activities organised by us;
• to understand customer patterns, behaviours and preferences;
• to monitor the safety of our stores and employees and/or detect crime or disruptive behavior;
• to investigate complaints;
• to promote and market our products and services;
• to improve existing or develop new products and services;
• to exercise a legal right, establish a claim, comply with a legal obligation;
• for group financial and other government reporting, as well as other operational purposes;
• other purposes required to operate and maintain our business as set out in our Personal Data Privacy Policy. A copy of our Personal Data Privacy Policy is available on our website at https://family.ikea.com.ph/pdpn.

RECIPIENTS

The Personal Data may be transferred/disclosed to, and processed by the following:

• Inter IKEA Systems B.V., other IKEA franchisees, our related corporations and affiliates for group financial and other government reporting, as well as other operational purposes;
• our vendors, suppliers, professional advisors and service providers, joint venture/business partners, appointed agents to assist us in our operations and for other business purposes;
• financial institutions to provide products and/or services to you and/or your småles member;
• public and governmental / regulatory authorities, courts and other alternative dispute forums, statutory boards, industry associations for statutory and other reporting purposes;
• insurers, where the insurance contract requires such disclosure;
• any third party in connection with any proposed or actual reorganisation, merger, sale, joint venture, assignment, transfer or other disposition or all or any portion of IKEA’s business, assets or stock (including in connection with any bankruptcy or similar proceedings);
• legal process participants and their advisors;
• any person for any of the Purposes set forth above and in our Personal Data Privacy Policy;
• any third party in order to comply with any law, regulations, court order or subpoena.

In this regard, please note that we may be transferring your and/or your småles member’s Personal Data outside of the Philippines to our central customer data storage and processing servers located overseas.

RETENTION

We will store and retain your and/or your småles member’s Personal Data for such period as may be required by applicable law or as may be needed to fully and efficiently achieve the Purposes, or as may be necessary to comply with our legal obligations, resolve disputes and enforce our agreements.

CONFIDENTIALITY

Your and/or your småles member’s Personal Data are treated as confidential and processed and securely.

SECURITY MEASURES

We are committed to ensuring that your and/or your småles member’s Personal Data are stored securely.

We apply appropriate technical, organizational and physical measures intended for the protection of Personal Data against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.

We use firewalls and data encryption to keep Personal Data safe. Personal Data in transit is always encrypted.

We limit access to Personal Data to employees who need to have access thereto in order to fulfill their functions.

We periodically conduct tests to determine our systems’ potential vulnerabilities and implement solutions to further strengthen our information security posture.

DATA SUBJECT RIGHTS

You have the following rights in relation to your and/or your småles member’s Personal Data held by us.

• Right to object. Data subjects shall have the right to indicate refusal to the collection and Processing of the Personal Data, including processing for direct marketing, automated processing, or profiling. Data subjects also have the right to withhold consent to further processing in case there are any changes or amendment to information given to the data subject. Once the data subject has notified IKEA of the withholding of consent, further processing of the personal data will no longer be permitted, unless:
• The Processing is required pursuant to a subpoena, lawful order, or as required by law;
  or
• There are other lawful bases or criteria under the PDPA for the collection and Processing of the Personal Data.
• Right to access. This right entitles the data subject to request access to Personal Data that IKEA processed about him, as well as certain information on such Processing.
• Right to rectification. This right entitles the data subject to request rectification or completion of any Personal Data that would be inaccurate or incomplete. Upon the request of the data subject, and after correction has been made, IKEA will inform any recipient of Personal Data of its inaccuracy and the subsequent rectification that was made.
• Right to erasure or blocking. In the absence of any other legal ground or overriding legitimate interest for the lawful Processing of the data subject’s Personal Data, or when there is substantial proof that the Personal Data is incomplete, outdated, false, or has been unlawfully obtained, the data subject may request IKEA to suspend, withdraw, or order the blocking, removal, or destruction of the Personal Data from IKEA’s filing system.
• Right to damages. The data subject shall have the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of the Personal Data, taking into account any violation of his rights and freedoms as a data subject, as provided by law.
• Right to lodge a complaint. The data subject shall have the right to lodge a complaint with the National Privacy Commission in case any of his rights as a data subject have been violated.
• Right to data portability. The data subject is entitled to receive a copy of Personal Data that he may have provided to IKEA, in such electronic or structured format for further use, subject to the guidelines of the National Privacy Commission with regard to the exercise of such right.

Upon the passing of the data subject, or in case of his incapacity or incapability to exercise his legal rights, the lawful heirs and assigns may invoke the data subject’s rights in his place.

The data subject’s rights under this clause are subject to limitations provided by law.

Please ensure that you provide complete and accurate Personal Data to us and keep us updated on any changes to your Personal Data.

You have the right at any time to request us to limit the processing and use of your and/or your småles member’s Personal Data (for example, requesting us to stop sending you and/or your småles member any marketing and promotional materials or contacting you and/or your småles member for marketing purposes).

You should be address your written requests or inquiries to:

• Data Protection Officer
• Ikano (Philippines) Inc
• Marina Way, Mall of Asia Complex
• Brgy. 76 Zone 10, CBP-IA
• 1300 Pasay City, Metro Manila, Philippines
• Contact # +63 2 5417216
• or by email to: dpo.ph@ikano.asia

COOKIES

We use cookies, web beacons and similar technologies on www.ikea.ph (the "Website") to improve our service to you. Some cookies we use are essential for some services on the Website to work; some cookies are used for authentication; others are used to collect information (statistics) of your use of the Website so that we can make the Website more convenient and useful for you. Some cookies are temporary and will disappear when you close your browser; others are persistent and will stay on your computer for some time. We are also using some local cookies that are tied to local campaigns and which will disappear when the campaign ends. Some of the cookies are strictly necessary for the functionality of the Website while others are used to enhance the performance of the Website and your user experience.

If you choose not to use cookies during your visit to the Website, you should be aware that certain functions and pages will not work as expected. As examples, you will not be able to use the shopping list feature and we will not be able to notify you of products and services that you may be interested in, based on your previous shopping experiences.

If you want to delete and control any cookies already on your computer, please refer to your browser vendor’s instructions by clicking "Help" in your browser menu.

For more details on our use of cookies, please refer to our Cookie Policy which forms an integral part of this Notice.

CHANGES

We reserve the right to update and amend this Membership Data Privacy Notice and our Personal Data Privacy Notice from time to time. We will notify you of any amendments via announcements on our website or other appropriate means. If we amend this Membership Data Privacy Notice and our Personal Data Privacy Policy, the amendment will only apply to Personal Data collected after we have posted the revised Membership Data Privacy Notice and Personal Data Privacy Policy.

CONSENT

By ticking the consent box or affixing your signature or submitting your and/or your småles’ member’s Personal Data to us, you expressly consent to us collecting, using, disclosing/transferring, storing, maintaining, accessing and otherwise processing such Personal Data for the Purposes and in accordance with the terms of our Membership Data Privacy Notice and our Personal Data Privacy Policy.

When you use the corresponding Membership Card/Number, or otherwise exercise your membership privileges, you confirm your consent to IKEA’s processing of the Personal Data.

It is necessary for us to collect and to retain such Personal Data. If you do not provide us with your and/or your småles member’s Personal Data, do not consent to this Membership Data Privacy Notice and our Personal Data Privacy Policy, or thereafter withdraw your consent, we will not be able to effectively provide products and/or services to you and/or your småles member, if at all.

We will also take it that all Personal Data provided by you and/or your småles member is accurate and complete, and that none of it is misleading or out of date as of the date of this Membership Data Privacy Notice. You will promptly update us in the event of any change to your and/or your småles member’s Personal Data.

In some circumstances, you may have provided Personal Data relating to other individuals (such as your spouse, family members or other third parties, including minors). You hereby represent and warrant that where you provide the Personal Data of other individuals to us, you are validly acting on their behalf and have obtained their consent to disclose their Personal Data to us for the Purposes for which we are collecting, using, disclosing, storing, maintaining, accessing and processing the Personal Data.

Your consent to this Membership Data Privacy Notice supplements but does not override nor replace any other consent you have previously granted or will grant us as regards the Personal Data. Nor does your consent to this Notice derogate against the existence of other lawful bases for our collection and processing of the Personal Data.

Date of issuance of this Membership Data Privacy Notice: 11 August 2021