Privacy Policy

Last updated October 23, 2026

INTRODUCTION AND APPLICATION

Must Celebrate (MC) is an event-planning, booking, payments and supplier-discovery platform operated by ARCAMOR TECHNOLOGIES OPC (ARCAMOR). This document establishes the terms applicable to the persons and activities described below. Related policies and transaction-specific schedules are incorporated where clearly disclosed and applicable.

Contractual provisions, prices and schedules presented before a transaction are to be interpreted alongside mandatory Philippine law. Nothing herein deprives any person of a non-waivable statutory or regulatory right.

COMMON DEFINITIONS AND INTERPRETATION

Must Celebrate / MC — the Must Celebrate mobile application, website, event-related services and marketplace operated by ARCAMOR TECHNOLOGIES OPC; MC is a platform name and not a separate legal entity.

ARCAMOR — ARCAMOR TECHNOLOGIES OPC, the legal operator of Must Celebrate / MC.

User / Customer — an eligible individual or entity accessing the Platform, including an Event Host or a person making a booking, as applicable.

Host — the registered User controlling an Event and, where activated, its Gift Fund.

Vendor / Supplier — a third-party merchant, supplier, individual, freelancer, sole proprietor or registered entity approved to list goods or services on MC.

Booking — a requested or confirmed transaction for a Vendor service or product through an MC booking flow.

Booking Value — the agreed amount payable for the underlying Vendor goods or services, excluding separately identified transaction fees unless expressly included.

Must Celebrate Processing Fee — a separately disclosed User-facing charge for a qualifying transaction, distinct from the Vendor Platform Fee.

Vendor Platform Fee — the fee contractually payable by the Vendor to ARCAMOR under the relevant tier or specific agreed fee schedule.

Payment Service Provider — an authorized external payment facilitator, such as PayMongo or another supported bank or regulated provider, handling relevant processing or payout services.

Gift Fund — the event-linked contribution feature, subject to the Gift Fund Terms and Gift Fund Withdrawal Terms.

CRR Policy — the Must Celebrate Cancellation, Rescheduling & Refund Policy and its disclosed applicable category schedules.

PHILIPPINE LEGAL FRAMEWORK

These provisions are interpreted consistently with applicable Philippine law, including Republic Act No. 11967 (Internet Transactions Act of 2023) and its implementing rules; Republic Act No. 7394 (Consumer Act of the Philippines); Republic Act No. 8792 (Electronic Commerce Act); Republic Act No. 10173 (Data Privacy Act of 2012) and its implementing rules; and the Civil Code of the Philippines. Payment and financial-service arrangements are also subject, to the extent applicable to the relevant person or provider, to Republic Act No. 11127 (National Payment Systems Act), Republic Act No. 11765 (Financial Products and Services Consumer Protection Act), Bangko Sentral ng Pilipinas regulations, payment-network requirements, and other binding rules. These references do not assert that ARCAMOR holds a banking, e-money, remittance or operator-of-payment-system license. Mandatory consumer, privacy and regulatory rights prevail over any inconsistent provision.

SUBSTANTIVE TERMS AND CONDITIONS

1. INTRODUCTION

PHILIPPINE LEGAL FRAMEWORK

This Privacy Policy shall be read consistently with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations and applicable National Privacy Commission issuances. Where personal-data processing arises from marketplace transactions, ARCAMOR will also administer its contractual obligations consistently with Republic Act No. 386 (Civil Code of the Philippines), Republic Act No. 7394 (Consumer Act of the Philippines) where applicable, and other mandatory Philippine laws, without treating contractual acceptance as a waiver of non-waivable privacy or consumer rights.

ARCAMOR TECHNOLOGIES OPC ("ARCAMOR", "we", "us" or "our") owns and operates Must Celebrate, including its mobile applications, websites, marketplace, software, communication tools, event-management features, Gift Fund functionality and related services collectively referred to as the "Platform."

ARCAMOR respects the privacy of individuals who use, access, interact with or are otherwise connected with Must Celebrate.

This Privacy Policy explains how ARCAMOR collects, uses, stores, accesses, organizes, shares, discloses, transfers, protects, retains and otherwise processes personal data in connection with Must Celebrate.

ARCAMOR processes personal data in accordance with Republic Act No. 10173, or the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), applicable issuances of the National Privacy Commission ("NPC"), and other applicable Philippine laws and regulations. ARCAMOR recognizes its accountability as a Personal Information Controller for personal data for which it determines the purposes and means of processing.

2. WHO THIS PRIVACY POLICY APPLIES TO

This Privacy Policy may apply to personal data relating to:

A person does not necessarily need to create a Must Celebrate account for this Privacy Policy to apply.

3. PERSONAL INFORMATION CONTROLLER

For personal data processed by ARCAMOR in connection with Must Celebrate for purposes determined by ARCAMOR, the relevant Personal Information Controller is:

ARCAMOR TECHNOLOGIES OPC Operator of Must Celebrate

Unit 3, Marpami Building San Lorenzo Phase 1C, Dita City of Santa Rosa, Laguna 4026 Philippines

Telephone: +63 977 275 5796

Privacy Contact: privacy@arcamor.com

Data Protection Officer: Data Protection Officer, ARCAMOR TECHNOLOGIES OPC

DPO Email: privacy@arcamor.com

Where another person or entity independently determines the purpose and manner of processing particular personal data, that person or entity may have separate privacy obligations under applicable law.

4. PRIVACY PRINCIPLES

ARCAMOR seeks to process personal data according to the principles of:

ARCAMOR also applies, as appropriate, data minimization, accuracy and data-quality controls, access controls, retention and secure-disposal controls, privacy by design and default, and accountability measures. Personal data should be adequate, relevant, suitable, necessary and not excessive for the declared, specified and legitimate purpose, and should not be retained longer than necessary or permitted by law.

Consistent with the DPA and IRR, ARCAMOR seeks to provide data subjects with clear and reasonably accessible information regarding the nature, purpose and extent of processing, including material data sharing, direct marketing, profiling or automated processing where applicable.

5. PERSONAL DATA WE MAY COLLECT

The personal data collected depends upon how a person interacts with Must Celebrate.

ARCAMOR may collect the categories described below where reasonably necessary and lawful.

6. ACCOUNT AND PROFILE INFORMATION

For registered Users, ARCAMOR may collect:

Where Users authenticate through services such as Google or Apple, ARCAMOR may receive information authorized by the User and made available by that authentication provider.

7. EVENT AND CELEBRATION INFORMATION

Must Celebrate may process information relating to celebrations and events, including:

Users should avoid placing unnecessary sensitive personal information into event descriptions, notes, messages or other free-text fields.

8. GUEST AND INVITATION INFORMATION

Event Creators or authorized collaborators may provide personal data relating to invited Guests.

This may include:

A Guest may therefore have personal data processed through Must Celebrate even without creating a registered account.

9. INFORMATION PROVIDED ABOUT OTHER PEOPLE

Where a User provides another person's personal data to Must Celebrate, such as when creating a guest list or sending an invitation, the User represents that the information is being provided for a legitimate event-related purpose and that the User has an appropriate lawful basis or authority to provide it. Where required, the User should provide the other person with appropriate notice that their personal data may be processed through Must Celebrate and direct them to this Privacy Policy.

Users should provide only information reasonably necessary for the relevant Platform function.

10. VENDOR INFORMATION

ARCAMOR may collect information relating to Vendors and their representatives, including:

Some Vendor information relates to a business entity rather than an identifiable individual and may not constitute personal data. Where Vendor information identifies or relates to an individual, this Privacy Policy applies.

11. BOOKING AND TRANSACTION INFORMATION

ARCAMOR may process:

12. PAYMENT INFORMATION

Payments may be processed through third-party payment service providers.

Depending upon the payment arrangement, ARCAMOR may process or receive:

ARCAMOR does not necessarily receive or store complete card numbers, CVVs, bank credentials or other full financial credentials where those details are collected directly and securely by an authorized payment provider.

The payment provider may independently process personal data according to its applicable privacy policy and legal obligations.

13. GIFT FUND INFORMATION

Where Must Celebrate provides Gift Fund functionality, ARCAMOR may process information including:

Gift Fund contributors may be subject to this Privacy Policy even where they do not maintain a registered Must Celebrate account.

14. MESSAGES AND COMMUNICATIONS

Must Celebrate may process communications sent through Platform messaging or support functions.

These may include:

ARCAMOR may access communications where reasonably necessary for Platform operation, safety, fraud prevention, dispute resolution, support, enforcement or legal compliance.

15. MOMENTS, PHOTOS, VIDEOS AND USER CONTENT

Users may be able to upload photographs, videos, captions, messages or other event-related content through features such as Moments.

Such content may contain personal data relating to the uploader or other identifiable individuals.

Users should consider the privacy of other people before uploading content.

Where appropriate, ARCAMOR may provide tools allowing content to be reported, restricted or removed.

16. REVIEWS AND RATINGS

ARCAMOR may process:

Reviews may be visible to other Platform users according to the applicable Platform functionality.

17. DEVICE, TECHNICAL AND USAGE INFORMATION

When a person accesses Must Celebrate, ARCAMOR or its service providers may automatically collect technical information such as:

The exact information depends upon the device, Platform configuration and services used.

18. LOCATION INFORMATION

Must Celebrate may process location-related information where necessary for features such as:

Where precise device location is requested, ARCAMOR will use the applicable device or Platform permission mechanisms where required.

Users may be able to disable device-location permissions through their device settings, although certain features may then function differently or become unavailable.

19. INFORMATION FROM THIRD PARTIES

ARCAMOR may receive personal data from:

20. HOW WE USE PERSONAL DATA

ARCAMOR may process personal data for purposes including:

21. BASIS FOR PROCESSING

Depending upon the circumstances and the category of personal data involved, ARCAMOR may process personal data only when a lawful criterion under the DPA, its IRR or another applicable law is satisfied. The applicable basis may differ by processing activity.

These may include:

Sensitive personal information and privileged information will be processed only when a condition permitted under Section 13 of the DPA or another applicable law is satisfied, and subject to appropriate safeguards. ARCAMOR will not treat a general acceptance of this Privacy Policy as consent for processing that legally requires a separate, specific consent.

ARCAMOR does not rely upon consent where another lawful basis appropriately applies merely for the purpose of characterizing all processing as consent-based.

22. CONSENT

Where processing requires consent, ARCAMOR will seek a freely given, specific and informed indication of the data subject's will, evidenced through written, electronic or recorded means as permitted by law. Consent requests will identify the relevant processing purpose with sufficient clarity and will be distinguishable from unrelated matters where appropriate.

Where processing is based on consent, the data subject may withdraw that consent through available Platform controls or by contacting ARCAMOR, subject to reasonable identity verification and applicable law.

Withdrawal of consent does not necessarily affect processing already lawfully undertaken before withdrawal.

Withdrawal may also not prevent continued processing where another lawful basis exists.

Certain Platform features may become unavailable where personal data necessary to provide those features can no longer be processed.

23. CONTRACTUAL NECESSITY

Certain personal data is necessary to create accounts, facilitate bookings, administer transactions, provide Vendor services or otherwise perform Platform-related contractual obligations.

Where required information is not provided, ARCAMOR may be unable to provide the applicable feature or service.

24. LEGITIMATE INTERESTS

Where permitted by applicable law and appropriate under the circumstances, ARCAMOR may process personal data for legitimate interests such as:

Where ARCAMOR relies on legitimate interests, it will assess the legitimacy of the interest, the necessity and proportionality of the processing, and the impact on the rights and freedoms of data subjects, and will implement safeguards where appropriate.

25. MARKETING COMMUNICATIONS

ARCAMOR may send marketing or promotional communications where permitted by law and consistent with applicable consent or other lawful processing requirements.

Users will be provided with a reasonably accessible mechanism to unsubscribe, withdraw applicable marketing consent, or object to direct marketing as provided by law. ARCAMOR will honor valid marketing opt-out requests, subject to reasonable time needed to implement the preference across relevant systems.

Operational communications concerning accounts, bookings, payments, security, policy changes or other necessary Platform matters are not necessarily marketing communications and may continue where necessary.

26. PUSH NOTIFICATIONS

Must Celebrate may send push notifications relating to:

Users may generally manage push-notification permissions through device or application settings.

27. AUTOMATED SYSTEMS, AI AND MODERATION

ARCAMOR may use automated systems, algorithms or artificial intelligence-assisted tools to support:

Automated tools may flag content, accounts or transactions for further action or human review.

Where automated processing or profiling is used in a manner that requires disclosure under the DPA or IRR, ARCAMOR will provide appropriate information regarding the processing, including its purpose and, where legally required, meaningful information about the methods or logic involved and the significance and envisaged consequences for the data subject. Where a decision producing legal effects or similarly significant effects is based solely on automated processing, ARCAMOR will implement consent, notification, human review or other safeguards required by applicable law and NPC rules.

28. WHO MAY RECEIVE PERSONAL DATA

ARCAMOR does not disclose personal data indiscriminately.

Personal data may be disclosed or made accessible to appropriate recipients where reasonably necessary and lawful.

Recipients may include the categories described below.

29. USERS AND VENDORS

Information may be shared between Users and Vendors where necessary for:

Only information reasonably relevant to the transaction should be shared.

30. EVENT PARTICIPANTS

Certain event information may be shared with:

31. SERVICE PROVIDERS AND PROCESSORS

ARCAMOR may engage third-party service providers to support Must Celebrate.

These may include providers of:

Where a third-party provider acts as a Personal Information Processor on ARCAMOR's behalf, ARCAMOR will use contractual or other reasonable means to require appropriate safeguards for the confidentiality, integrity and availability of personal data; restrict processing to documented and authorized purposes; require appropriate security and breach-management obligations; and require compliance with the DPA, its IRR and applicable NPC issuances. ARCAMOR remains accountable for personal data under its control as required by law.

32. CURRENT TECHNOLOGY AND SERVICE PROVIDERS

Must Celebrate may use third-party technology providers such as:

The specific provider used for a particular transaction or feature may change over time.

Third-party providers may process information under their own terms and privacy obligations where they independently determine relevant processing purposes.

33. PROFESSIONAL ADVISERS

Personal data may be disclosed where reasonably necessary to:

34. GOVERNMENT AND LEGAL DISCLOSURES

ARCAMOR may disclose personal data where reasonably necessary to:

35. CORPORATE TRANSACTIONS

If ARCAMOR undergoes or considers a:

personal data may be disclosed to appropriate parties involved in the transaction, subject to reasonable confidentiality, security and applicable legal requirements.

36. WE DO NOT SELL PERSONAL DATA AS A DATA-BROKER BUSINESS

ARCAMOR does not operate Must Celebrate as a business whose purpose is selling individuals' personal data to third parties.

This does not prevent disclosures or transfers described in this Privacy Policy where necessary for Platform operation, transactions, service providers, legal compliance or other lawful purposes.

37. INTERNATIONAL AND CROSS-BORDER PROCESSING

Must Celebrate relies upon cloud, software, authentication, payment and other service providers that may operate infrastructure or personnel outside the Philippines.

Accordingly, personal data may be stored, accessed, transmitted or otherwise processed in countries outside the Philippines.

Where cross-border processing occurs, ARCAMOR will remain accountable for personal data under its control and will use contractual or other reasonable means designed to provide a comparable level of protection, taking into account the DPA, its IRR, applicable NPC issuances, the nature of the processing, and the safeguards of the recipient or service provider.

Use of Must Celebrate does not necessarily mean that all personal data will remain physically stored within the Philippines.

38. DATA SECURITY

38A. EXTERNAL EVENTS AND SERVICE INTERRUPTION

ARCAMOR is not responsible for service interruption or delay caused solely by extraordinary events beyond its reasonable control, including widespread infrastructure, telecommunications, utility, cloud-service, or government-imposed disruptions, to the extent permitted by law. This clause does not reduce ARCAMOR's obligations under the Data Privacy Act, applicable NPC rules, or other mandatory law to maintain reasonable and appropriate safeguards, respond to personal data breaches, mitigate harm, and make legally required notifications.

ARCAMOR implements reasonable and appropriate organizational, physical and technical security measures intended to protect personal data against natural and human dangers, accidental or unlawful destruction, alteration, loss, unauthorized disclosure, unauthorized access, fraudulent misuse and other unlawful processing, taking into account the nature of the personal data, risks represented by the processing, size and complexity of operations, current data-protection practices and the cost of implementation.

Measures may include, where appropriate:

secure disposal or deletion procedures; personnel confidentiality obligations that continue as appropriate after employment or engagement; periodic review of security measures; and other reasonable safeguards appropriate to the risks.

No internet-connected information system can be guaranteed to be completely secure.

39. PERSONAL DATA BREACHES

ARCAMOR maintains or intends to maintain procedures for identifying, assessing, containing, investigating and responding to personal data breaches.

Where a personal data breach is subject to mandatory notification under the DPA, IRR or applicable NPC rules, ARCAMOR will notify the National Privacy Commission and affected data subjects within seventy-two (72) hours upon knowledge of, or reasonable belief that, a notifiable personal data breach has occurred, subject only to postponement, exemption or other treatment permitted or authorized by law or the NPC.

A breach may require notification where sensitive personal information or other information that may enable identity fraud is reasonably believed to have been acquired by an unauthorized person and the incident is likely to give rise to a real risk of serious harm, or where another applicable NPC notification threshold is met. Notifications will contain the information required by applicable law, which may include the nature of the breach, personal data possibly involved, measures taken to address and mitigate the breach, relevant contact details, and guidance or assistance for affected data subjects.

ARCAMOR will document security incidents and personal data breaches in accordance with applicable NPC requirements, including incidents that do not meet the threshold for mandatory notification, and will maintain incident-response and breach-management procedures.

ARCAMOR may also take measures to:

40. DATA RETENTION

ARCAMOR retains personal data only for as long as necessary or permitted for the declared, specified and legitimate purposes for which it was collected or subsequently lawfully processed, and in accordance with applicable legal, regulatory, contractual and legitimate business-record requirements.

Platform operation;

contractual performance;

transaction administration;

tax and accounting requirements;

fraud prevention;

security;

dispute resolution;

legal claims;

regulatory compliance;

and legitimate business-record requirements.

Different categories of information may have different retention periods. ARCAMOR will maintain or implement a data-retention schedule or documented retention criteria appropriate to its processing activities. When personal data is no longer necessary and no lawful basis for retention remains, ARCAMOR will securely delete, destroy, anonymize or otherwise dispose of it using reasonable methods intended to prevent further unauthorized processing or recovery.

41. ACCOUNT DELETION

Where supported by the Platform, Users may request account deletion.

Account deletion does not necessarily result in immediate deletion of every record associated with the account.

ARCAMOR may retain information where reasonably necessary or legally required for:

Where information no longer needs to identify an individual, ARCAMOR may delete, anonymize, aggregate or otherwise appropriately de-identify it.

42. GUEST INFORMATION RETENTION

Guest information may be retained for the duration reasonably necessary to administer the relevant event and associated records.

Certain guest-related information may remain associated with transaction or event history where necessary for:

Cancelling an invitation does not necessarily require deletion of all historical records associated with that Guest.

43. VENDOR RECORD RETENTION

Vendor information may be retained after termination of a Vendor account where necessary for:

44. CHILDREN AND MINORS

44A. ACCOUNT ELIGIBILITY AND MINOR-RELATED CONTENT

A person under eighteen (18) years old may be the subject of an Event, invitation, guest record, photograph, video, Moment, or other Event-related content, but is not eligible to independently register for or operate a MUST CELEBRATE User account where the User Terms require a minimum age of eighteen (18). Where processing of a minor's personal data requires parental, guardian, or other lawful authorization, ARCAMOR may require appropriate evidence of that authority and may restrict or remove content where necessary to protect the minor or comply with law.

Must Celebrate may involve celebrations concerning children and may contain photographs, invitations or event information relating to minors.

The Platform is not intended to encourage children to independently provide unnecessary personal data.

Where consent of a parent, guardian or other authorized person is legally required for processing personal data relating to a minor, ARCAMOR may require appropriate authorization.

Users uploading information or content concerning minors should have an appropriate basis and authority to do so.

ARCAMOR may restrict or remove content or accounts where necessary to protect minors or comply with applicable law.

45. SENSITIVE PERSONAL INFORMATION

Certain Platform activities may involve information classified as sensitive personal information under the DPA, which may include information concerning an individual's age, marital status, health, education, government-issued identifiers, licenses, tax information, or other categories protected by law. Privileged information may also receive special protection under applicable law.

ARCAMOR will limit collection and processing of sensitive personal information and privileged information to circumstances where it is necessary, proportionate, supported by a lawful condition, and protected by reasonable and appropriate safeguards.

Users should not voluntarily place sensitive personal information into public profiles, reviews, event descriptions, Moments or messages unless necessary and appropriate.

46. PUBLIC AND SHARED INFORMATION

Certain information intentionally published through Must Celebrate may be visible to other people.

This may include, depending upon Platform settings:

Users should consider the intended audience before publishing information.

47. COOKIES AND SIMILAR TECHNOLOGIES

Must Celebrate websites and web-based services may use cookies, local storage, software development kits, pixels or similar technologies for purposes such as:

Where legally required, ARCAMOR may provide additional notice or consent mechanisms for particular technologies.

48. ANALYTICS

ARCAMOR may use analytics to understand how Must Celebrate is used, identify errors, measure feature performance, improve user experience and support business decisions.

Where reasonably practicable, ARCAMOR may use aggregated or de-identified information for analytics and statistical purposes.

49. DATA SUBJECT RIGHTS

Subject to applicable law and relevant limitations, individuals may have rights concerning their personal data, including the:

Applicable rights depend upon the circumstances, the legal basis of processing and limitations recognized by law. Rights may also be exercised by lawful heirs or assigns after the death of a data subject, or where the data subject is incapacitated or incapable of exercising the rights, to the extent provided by the DPA and IRR.

50. EXERCISING PRIVACY RIGHTS

A data subject may submit a privacy request to:

privacy@arcamor.com

ARCAMOR may request reasonable information to verify the identity and authority of the requester before acting upon a request and may request clarification where reasonably necessary to identify the personal data or processing activity concerned. Verification measures will be proportionate to the sensitivity of the request and intended to prevent unauthorized access, correction, disclosure or deletion.

This is intended to prevent unauthorized access to or deletion of another person's information.

ARCAMOR will acknowledge, evaluate and respond to valid privacy requests within the period and in the manner required by applicable law and NPC rules. Where a request is denied or limited, ARCAMOR may provide the legal or factual basis for the limitation where required or appropriate.

51. RIGHT TO ACCESS

Subject to applicable law, a data subject may request reasonable access to personal data ARCAMOR processes about them, including, where applicable: the contents of the personal data; sources from which it was obtained; names and addresses or classes of recipients; manner of processing; reasons for disclosure; information concerning relevant automated processes; the date the personal data was last accessed or modified where available and required; and the identity and contact details of the relevant Personal Information Controller.

52. RIGHT TO CORRECTION

A data subject may dispute inaccuracies or errors and request correction of personal data that is inaccurate or materially incomplete. Where correction is required by law, ARCAMOR will take reasonable steps to correct the data and, upon reasonable request where applicable, inform relevant recipients or third parties that previously received the inaccurate data of the correction.

Certain information may also be updated through Platform account settings.

53. RIGHT TO OBJECT

Where provided by applicable law, a data subject may object to processing, including processing for direct marketing, automated processing or profiling. Where processing is based on consent, a data subject may also withhold or withdraw consent in accordance with law.

An objection does not necessarily require ARCAMOR to cease processing where processing remains permitted or required under applicable law, such as where information is necessary for contractual performance, legal obligations, legal claims or another lawful basis.

54. RIGHT TO ERASURE OR BLOCKING

A data subject may request suspension, withdrawal, blocking, removal or destruction of personal data in circumstances recognized by law, including where the data is incomplete, outdated, false or unlawfully obtained; used for an unauthorized purpose; no longer necessary for the purpose collected; processed unlawfully; or where consent has been validly withdrawn or an objection applies and no other lawful ground permits continued processing.

This right is not absolute.

ARCAMOR may retain information where retention remains lawful and necessary for:

55. DATA PORTABILITY

Where personal data is processed by electronic means and in a structured and commonly used format, and the legal requirements for portability are met, a data subject may request a copy in an electronic or structured format that allows further use, subject to applicable NPC technical standards, procedures and limitations.

55A. RIGHT TO DAMAGES

Where legally applicable, a data subject may seek indemnification for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data, taking into account any violation of the data subject's rights and freedoms, subject to applicable law and the jurisdiction of the NPC or courts.

56. COMPLAINTS TO THE NATIONAL PRIVACY COMMISSION

Data subjects may lodge complaints concerning alleged violations of privacy rights with the National Privacy Commission of the Philippines, subject to applicable procedures.

ARCAMOR encourages individuals to first contact its privacy contact or Data Protection Officer so that concerns may be investigated and, where appropriate, resolved.

Nothing in this provision restricts a person's rights before the NPC.

57. VENDOR RESPONSIBILITIES FOR PERSONAL DATA

Vendors receiving personal data through Must Celebrate must use such information only for legitimate purposes connected with:

Vendors must not unlawfully:

58. EVENT CREATOR RESPONSIBILITIES

Event Creators should respect the privacy of Guests and other participants.

Event Creators should not upload unnecessary personal data or disclose sensitive information about another person without an appropriate basis.

Where Must Celebrate provides privacy or sharing controls, Event Creators are responsible for using those controls appropriately.

59. USER RESPONSIBILITY FOR CONTENT

Users remain responsible for determining whether they have an appropriate basis to upload personal information, photographs, videos or other content concerning other individuals.

ARCAMOR may respond to valid privacy complaints or lawful requests concerning User-generated content.

60. LINKS AND THIRD-PARTY SERVICES

Must Celebrate may contain links to external websites, Vendor pages or third-party services.

ARCAMOR does not control the independent privacy practices of unrelated third parties.

Users should review the privacy notices of third-party services before providing personal data directly to them.

61. PRIVACY BY DESIGN AND PLATFORM DEVELOPMENT

As Must Celebrate develops, ARCAMOR may introduce new features, products, integrations, automated tools or services.

ARCAMOR will integrate reasonable privacy and data-protection considerations into the design, development, testing, deployment and material modification of Platform features and processing activities, including data minimization, role-based access, appropriate default settings and safeguards proportionate to risk.

ARCAMOR will conduct privacy impact assessments or comparable risk assessments where required by applicable NPC rules or where processing is likely to present heightened privacy risks, and may conduct them for other material processing changes as a governance measure.

62. DATA PROTECTION OFFICER AND PRIVACY GOVERNANCE

ARCAMOR will designate a Data Protection Officer ("DPO") or other accountable individual(s) as required by the DPA, its IRR and applicable NPC issuances, and will maintain privacy-governance measures appropriate to its operations. The identity and contact details of the accountable privacy contact will be made available to data subjects as required by law.

The DPO or designated privacy contact may oversee matters including:

63. CHANGES TO THIS PRIVACY POLICY

ARCAMOR reserves the right, at its discretion and to the extent permitted by applicable law, to amend, revise, supplement, replace or otherwise modify this Privacy Policy from time to time whenever ARCAMOR considers such changes necessary or appropriate for:

64. NOTICE OF MATERIAL PRIVACY CHANGES

The then-current version of this Privacy Policy shall be made reasonably accessible through Must Celebrate.

Where required by applicable law or where ARCAMOR determines that a change materially affects how personal data is processed, ARCAMOR may provide notice through:

Where a change materially affects information previously supplied to a data subject, ARCAMOR will provide appropriate notice and, where required by law, an opportunity to object, withhold consent or provide a new consent before the affected processing is undertaken.

65. EFFECTIVE DATE OF AMENDMENTS

An amended Privacy Policy shall take effect on the effective date stated in the revised Policy.

Continued use of Must Celebrate after an amendment does not replace any specific consent that applicable law requires ARCAMOR to obtain separately.

Processing performed before an amendment remains subject to applicable law and the lawful basis existing at the relevant time.

66. RELATIONSHIP WITH OTHER MUST CELEBRATE TERMS

This Privacy Policy should be read together with applicable Must Celebrate documents, including:

This Privacy Policy principally governs the processing of personal data.

Where another Must Celebrate document contains a provision concerning personal-data processing, the documents should be interpreted consistently where reasonably possible and subject always to mandatory privacy law.

67. GOVERNING PRIVACY LAW

This Privacy Policy shall be interpreted in accordance with applicable Philippine privacy and data-protection law, including the Data Privacy Act of 2012, its Implementing Rules and Regulations and applicable issuances of the National Privacy Commission.

Nothing in this Privacy Policy is intended to waive or restrict rights that cannot lawfully be waived or restricted.

68. CONTACT ARCAMOR ABOUT PRIVACY

For privacy questions, requests, concerns or complaints, contact:

ARCAMOR TECHNOLOGIES OPC Data Protection Officer / Privacy Contact

Unit 3, Marpami Building San Lorenzo Phase 1C, Dita City of Santa Rosa, Laguna 4026 Philippines

Privacy Email: privacy@arcamor.com

Telephone: +63 977 275 5796

69. ACKNOWLEDGMENT

This Privacy Policy is a notice explaining ARCAMOR's personal-data processing practices. Mere use of Must Celebrate or acknowledgment of this Privacy Policy does not, by itself, constitute consent for any processing activity for which the DPA or another applicable law requires a separate, specific and informed consent.

Where ARCAMOR relies upon consent for a particular processing activity, consent may be requested separately through an appropriate mechanism.

LEGAL BASIS NOTE

This Policy is intended to be read and implemented consistently with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission. If a mandatory legal requirement conflicts with this Policy, the mandatory requirement shall prevail to the extent of the conflict.

ADDITIONAL PLATFORM PRIVACY DISCLOSURES

Optional Registration Mobile Number and OTP

A mobile number is ordinarily optional for basic customer account creation, but MC may request and verify a number by OTP to enable a first paid booking, Vendor verification, Ambassador benefits, Gift Fund withdrawal or other security-sensitive features. OTP records, device signals, attempts and verification status may be processed for account security and fraud mitigation under lawful grounds and limited retention.

Ambassador QR Codes and Referral Attribution

If a User enters or scans an approved Ambassador referral code or QR code, MC may record referral identifiers, conversion steps, verification status and qualified activation events for attribution and legitimate program administration. A referring Ambassador should not receive unnecessary sensitive profile data, exact Gift Fund balances, full payment details or unrelated personal data.

Privacy Requests and Contact

For data subject requests, contact the ARCAMOR Data Protection Officer through privacy@arcamor.com. Support and booking-related requests may be sent to support@arcamor.com / support@mustcelebrate.com. Data subject rights and applicable exemptions are governed by the Data Privacy Act of 2012 and National Privacy Commission rules.

PRIVACY NOTICE AND ACKNOWLEDGMENT

This Privacy Policy provides notice of how ARCAMOR TECHNOLOGIES OPC collects, uses, shares, protects and otherwise processes personal data in connection with Must Celebrate / MC. Making the notice available or acknowledging receipt does not by itself constitute consent for every processing activity.

Where consent is the applicable lawful basis, ARCAMOR shall request a separate, specific and appropriately informed indication of consent as required by the Data Privacy Act of 2012 and applicable rules. Other processing may rely on a different lawful basis where legally permitted.

Data subjects retain their applicable statutory rights, including rights to information, access, correction and other remedies under Philippine law. Privacy-related questions and requests may be directed to privacy@arcamor.com.

POLICY INTERPRETATION, CHANGES AND STATUTORY RIGHTS

This Policy shall be read and interpreted together with the other applicable Must Celebrate / MC policies, agreements, booking confirmations, transaction-specific terms and disclosures expressly relevant to the User, Vendor, feature or transaction concerned.

Where an expressly disclosed and validly accepted transaction-specific term or applicable Category Schedule conflicts with a general commercial description, the more specific term shall ordinarily govern that transaction, provided it is consistent with mandatory Philippine law. No such term shall override applicable data-privacy requirements or other non-waivable statutory rights.

ARCAMOR TECHNOLOGIES OPC may amend or update this Policy in accordance with applicable law. Updates shall be appropriately dated, made reasonably accessible through Must Celebrate / MC and communicated to affected persons where notification is required.

Unless otherwise required by law or validly agreed by the affected parties, amendments shall apply prospectively and shall not retroactively change confirmed transactions or remove accrued rights and obligations.

Nothing in this Policy excludes, restricts or waives any consumer, privacy, contractual or other statutory right that cannot lawfully be excluded, restricted or waived under the laws of the Republic of the Philippines.

CONTACT INFORMATION

ARCAMOR TECHNOLOGIES OPC — Operator of Must Celebrate / MC

Email: support@arcamor.com / support@mustcelebrate.com

Privacy Email: privacy@arcamor.com

Telephone: +63 977 275 5796

Website: https://www.mustcelebrate.com

Office: Unit 3, Marpami Building, San Lorenzo Phase 1C, Dita, City of Santa Rosa, Laguna 4026, Philippines

Complaints, requests for assistance and privacy inquiries may be submitted through the contact details above or through the available Platform support functions. Individuals may also seek redress from competent Philippine authorities where applicable.