Privacy Notice – The Mountain Bank

Version v1.2

1. Introduction

The Mountain Bank (“TMB”) recognizes the importance of the protection of your Personal Data and compliance with relevant laws and regulations, and hence produces the Privacy Notice (“Notice”).

Who we are. TMB is a financial institution licensed by Monetary Authority of Ta'ang State. The Android application is published under package com.tmb.mobile. This Notice is also published at https://www.themountainbank.com/legal/privacy. These Terms are published at https://www.themountainbank.com/legal/terms.

Personal Data include, but not limited to, any data that can be used to identify a person such as personal particulars name, NRIC number, passport number, address, telephone number, specimen signatures, employment details, banking information, images and voice recording of conversation and any other personal information you have provided to us.

This Notice explains how TMB collects, uses, discloses, and protects your Personal Data, as a data subject, under applicable Personal Data protection laws, including standards aligned with global best practices. We are committed to protecting your privacy and ensuring the secure and responsible handling of your information.

2. To whom this notice will apply

This Notice applies to the following classified person or persons.

3. Collection of Personal Data

3.1 Channels of collection

TMB will collect your Personal Data through the various channels below. TMB will take care of your personal information, and will collect, use or disclose your personal information only if the Bank deems it necessary, correct and appropriate, and to notify you of the data subject rights as stipulated in this Privacy Notice.

Direct Collection: The Personal Data that you give directly to or through TMB, or held by TMB by your use of products and/or services, contact, visit, joining activities, search via service channels and/or TMB’s contact channels such as branch, head office, website, application, online social media account of TMB, email, banking agent, financial service machines, cheque direct service, direct service centers, telephone, postal mail, short message service (SMS), questionnaire, name card, meeting, training, seminar, event, recreation, marketing promotion activity, contact or any other channel.

Indirect Collection: The Personal Data received or accessed by TMB from other sources, such as government agencies, other companies, banks or financial institutions, financial service providers and other service providers of TMB, business partners and service providers of business partners, companies that jointly issue products and/or services with TMB, TMB’s customers, individuals or juristic persons conducting a transaction with TMB, online social media, online platform of third party, public data sources (such as Government Gazette), a person having legal authority or legal right, any other person or agency with which TMB has a legal relationship, etc.

3.2 Consent

In some instances, TMB may ask for your consent to collect, use, or disclose your Personal Data to maximize your benefits and/or to enable us to provide services to fulfil your needs for verification of your identity before continuing the transaction and for Know Your Customer (KYC) process, for the purpose of offering or providing products, services and benefits suitable to you, and other activities which we may require your consent.

4. Types of Personal Data Collected

4.1 Personal Data TMB collects includes, but is not limited to:

(1) Personal information — name-surname, gender, date of birth, age, information stated or recorded in documents such as national identification card, passport, household registration list, alien identification card, social security card, driving license, car registration book, or house registration, signature, information about family members, facial photograph, education, occupation, status, membership, work history, benefits other than compensation for work, information relating to the taking out of insurance.

(2) Contact information — the address specified in the household registration list or the national identification card, address for document delivery, electronic mail address, home phone number, mobile phone number, facsimile number, name or account for use of service via applications or digital channels (such as LINE, Google, Facebook, YouTube, Twitter, WhatsApp or WeChat or others), information of contact person provided to the Bank.

(3) Financial and transaction information — deposit account number, investment account number, credit card number, debit card number, type of credit and debit cards, deposit account movement, information on transactions made through electronic cards or via electronic or digital channels, income and expenditure information, credit information, credit rating information, debt payment information, asset information, financial status information, risk assessment information, information generated from an analysis of Personal Data, information on any wrongdoing including accusation thereof, litigation or prosecution information, insurance/investment information initiated through the Bank, payment information, information for compliance with AML and FATCA, and any other information related to the use of or request for services and transactions with the Bank.

(4) Contact with the Bank — information received through branches, telephones, electronic or digital channels, social media, CCTV and off-site services which may be displayed or recorded in written form, voice or transaction tape recording, photos or moving pictures.

(5) Technical information — IP address, MAC address, network/device identifiers, log, device ID, API, cookies, plug-in/browser/OS/platform information, internet or mobile network, geographic location, device setting and other technical data derived from use of any platform, application and operating system of the Bank.

(6) Usage information — username, password, search information, visit statistics, menu used, time spent on the website, platform and application, timestamp of last click, favorite items, Q&A, log file, communication information with the Bank.

(7) Behavioral information — information relating to personal interests or preferences, and manner of use or of service utilization.

4.2 Sensitive Personal Data

Sensitive Personal Data, namely, information concerning biometric data (such as facial recognition, fingerprint recognition, iris recognition and voice recognition data), religion, criminal record, health data, disability, other information of similar sensitivity, or any other data as prescribed by the relevant government agencies or regulatory agencies.

4.3 Minors and persons lacking capacity

If TMB has acknowledged that there is a need to obtain consent from data subjects who are minors and cannot lawfully give consent by themselves, we will not collect their Personal Data until the consent of the persons exercising parental power is obtained. In addition, any Personal Data from quasi-incompetent persons or incompetent persons will not be collected until the consent of their legal curators and guardians is obtained (as the case may be).

5. Use of Personal Data Collected

5.1 Purposes

The Personal Data of data subjects may be used for purposes including:

• Verifying your identity and performing KYC checks
• Processing and managing accounts, loans, deposits, and other services
• Providing digital and mobile banking services, including deposits, withdrawals, P2P and branch transfers, bill payments, merchant payments, payroll, cardless ATM, QR payments, and loan products (consumer loan, overdraft, salary advance) where offered
• Conducting analytics, risk management, and fraud prevention
• Complying with legal and regulatory obligations
• Providing customer service and responding to inquiries
• Improving customer service and TMB’s products
• Sending notifications regarding services and changes in TMB’s regulations
• Advertising and marketing (with your consent), including introducing new banking services, providing information about new services, promotional campaigns for customer relations, and notifying customers of changes to the Bank’s regulations

5.2 Additional consent

Where TMB needs to use the provided Personal Data of the data subjects based on the purposes mentioned above, TMB shall ask for additional consent from the data subjects stating the added purpose for using the Personal Data.

6. Objectives for Collecting, Using and Disclosing Personal Data

TMB will collect, use and/or disclose your Personal Data only as necessary under TMB’s legitimate objectives which include the collection, use and/or disclosure of Personal Data for compliance with the contract in which data subjects are a contract party, for performance of duties as required by law, for legitimate and/or public interest, for operations according to the consent of data subjects and/or for operations under other lawful bases.

TMB may also use Personal Data for marketing, branding, promotion, and promotional campaigns that have mutual benefits for customers and the Bank, subject to applicable consent requirements.

Where necessary for fraud prevention, security investigations, or cooperation with competent authorities, TMB may disclose CCTV recordings and related security footage as permitted by applicable law.

7. Disclosure of Personal Data

7.1 General

Under the consent of data subjects or criteria permitted by law, TMB may disclose the Personal Data of data subjects to a third party. Persons or agencies receiving such Personal Data will collect, use and/or disclose the Personal Data of data subjects within the scope for which data subjects have given consent, or within the scope related to this Policy. In certain cases, the data subjects may be under the Personal Data protection policy of such recipients of Personal Data. The recipient of Personal Data of data subjects may be in Myanmar or other countries.

7.2 Recipients

TMB may share the Personal Data with:

• Persons having legal authority or legal rights and/or for compliance with law such as regulatory authorities, law enforcement agencies, and courts
• For the benefit of TMB’s business operation, advisors and experts such as auditors, legal advisors and tax advisors
• For conducting business operation on behalf of TMB or to support the provision of TMB’s products and/or services, companies, trade partners, TMB’s agent, sub-contractor or external service providers in Myanmar and other countries that have entered into contracts with TMB
• TMB’s business partners (where Personal Data is disclosed for their marketing purposes, TMB will notify data subjects of the names of business partners for supporting decision in giving consent; business partners can rely on the consent TMB obtains)
• Any other third party for the objectives as specified in this Notice

7.3 Cross-border transfer

TMB may need to send or transfer data subjects’ Personal Data to other companies located in other countries, or to other recipients of data, as part of TMB’s normal business operation — for example storage on cloud platforms or servers located in other countries, cross-border fund transfer data via international funds transfer management intermediaries, a trade partner which is a private banker in another country, online social media service providers, government agencies in other countries and/or a person having connection with the transaction of data subjects in other countries.

7.4 Overseas safeguards

In case TMB is required to send or transfer Personal Data overseas, due diligence will be undertaken by TMB beforehand regarding the standards for personal data protection of the data recipients and the respective countries. However, it must be noted that TMB cannot be held liable for data breaches due to the technical failures of data recipients or the sudden changes to the laws of the respective countries.

9. Security Measures

9.1 Safeguards

TMB implements robust administrative, technical, and physical safeguards to protect Personal Data against unauthorized access, disclosure, alteration, or destruction. These include data encryption, secure servers, access control policies, regular audits, and employee training on data protection.

9.2 Data breach response

In case of data breach, TMB will take the following steps:

• Email and In-App notification will be sent to data subjects in step of anyone logging into the account since One-device per account can only be logged in at a time.
• If a customer complains about lost phone or unauthorized access, the bank needs a customer complaint from TMB’s website or App, to freeze the account for a limited time period.

10. Your Rights

Depending on applicable laws, you may have rights to:

10.1 Right to Request Access and Obtain a Copy of Personal Data

Data subjects have the right to request access to and obtain a copy of Personal Data that was provided and in the TMB's possession or under its control, or to request the TMB to inform data subjects of how such personal data has been obtained by the Bank without their consent.

Access and copy requests are subject to identity verification (KYC) by the Bank. The Personal Data that may be provided is Personal Data you provided to the Bank for receiving the Bank’s services (see section 4).

10.2 Right to Withdraw Consent at Any Time

Data subjects have the right to withdraw consent given to TMB for the collection, use and disclosure of Personal Data at any time. Please note that the withdrawal of such consent may lead to the distraction or suspension of the products or services that TMB have provided or data subjects have requested for.

10.3 Right to Object or Restrict Processing

Data subjects are entitled to lodge an objection to the collection, use or disclosure of your Personal Data at any time. They may object in the event that:

• TMB has collected Personal Data to the extent necessary for the purpose of performing TMB’s tasks for public interest or exercising of rights entrusted to government agencies, or for legitimate interest of TMB or other persons or juristic persons,
• TMB has collected, used or disclosed your personal data for direct marketing purposes, or
• TMB has collected, used or disclosed your personal data for scientific, historical or statistical purposes unless it is necessary to perform TMB’s task for public interest.

10.4 Right to Request Deletion, Anonymization, or Blocking of Data

Data subjects are entitled to request TMB to delete or destroy Personal Data or make it anonymous if they believe that their Personal Data has been collected, used and/or disclosed illegitimately, which is not in compliance with applicable laws or if they deem that it is no longer necessary for TMB to keep their Personal Data under the objectives of this Policy or when they exercise their right to withdraw consent or their right to object as mentioned earlier.

10.5 Right to Suspend the Use of Personal Data

Data subjects have the right to suspend the use of Personal Data in the event that (1) TMB is in the process of verifying their Personal Data to be accurate and up-to-date as requested, (2) TMB has unlawfully collected, used or disclosed their personal data, (3) it is no longer necessary for TMB to collect, use or disclose their Personal Data for any purpose, but they have requested TMB to collect their personal data for their lawful interest, or (4) TMB is in the process of verification or examination of their objection request to TMB’s collection, use or disclosure of their personal data. Please note that suspending TMB's use of Personal Data, it may not be possible for TMB to provide data subjects with the products or services that have been requested for.

10.6 Right to rectify personal data

Data subjects have the right to request the Bank to rectify their Personal Data so as to be accurate, up-to-date, complete and not misleading.

10.7 Lodge a complaint with a data protection authority

Data subjects have the right to lodge a complaint to any competent agency or any entity with legal authority in the event that TMB or its data processor, including, but not limited to, employees or contractors of TMB, violate or do not comply with applicable laws on personal data protection.

11. Use of Cookies and Tracking

TMB’s websites and mobile apps may use cookies, beacons, and similar technologies to enhance user experience, collect usage data, and facilitate marketing. Data subjects can manage their cookie preferences through their browser settings.

12. Changes to this Privacy Notice

This Privacy Notice may be updated periodically to reflect changes in TMB’s practices or legal obligations. Updated versions will be posted on our official website or made available at our branches.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Notice or your Personal Data, you may contact: