DATA PRIVACY

I. Purpose

In compliance with the Republic Act No. 10173 known as Data Privacy Act of 2012, “An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, creating for this Purpose a National Privacy Commission, and for Other Purposes,” this data privacy policy has been designed by Ortigas and Company, Limited Partnership (OCLP) to ensure protection of the right to privacy and communication of all partners and stakeholders while promoting easy access and flow of information.         

This data privacy policy states OCLP’s responsibilities for:

1. Compliance with data protection laws, regulations and best practices
2. Protection for the rights of staff, partners and stakeholders
3. Transparency about how personal data is stored and processed
4. Prevention from the possibility of data breach

Furthermore, this data privacy policy shall guide the company and protect it against real data security risks such as breaches of confidentiality, reputational damage and failure to offer choices on personal data usage.

II. Data Privacy Policy

As part of our commitment to protect your privacy, OCLP adheres to the following principles:

1. We shall comply with all applicable laws and regulations.
2. We value the personal information given to us by our partners and we commit to use them in a way that is fair and worthy of their trust.
3. We shall take all reasonable steps to keep confidentiality of information secure and prevent it from misuse.
4. We shall be transparent in providing clear information about how we handle the information by clearly explaining the following:

a. Policy Scope

This data privacy policy shall cover all personal information collected by OCLP in connection with the products and services it offers. In this policy, “personal information” means information or pieces of information that may be used to identify an individual, including, but not limited to:

1. Basic profile information such as name, date of birth, gender, local/present/mailing address, nationality and contact details.
2. Identity supporting documents such government issued IDs and governments issued forms
3. Contact details which includes mobile/landline number, home/office number, email address and mailing address
4. Payment details which include credit card, bank account number and other related information
5. Information about business, lifestyle or preferences such as hobbies and interests

This policy shall also apply to the following:

1. All branches of Ortigas & Company, Limited Partnership
2. All regular and contractual employees of Ortigas & Company, Limited Partnership
3. All customers of Ortigas & Company, Limited Partnership
4. All contractors, suppliers and other people contracted to represent or work on behalf of Ortigas & Company, Limited Partnership
5. Other stakeholders

b. Why we need your information?

For the company to provide the best product and customer experience, collection and analysis of data becomes a relevant process. The collected data shall be used whenever applicable. Listed below are several operations where private information is considered as an essential component.

1. Providing support efficiently to any individual with issues, inquiries, requests and any other related activities.
2. Managing of user account especially if there are issues to be settled.
3. Training of staff and other related personnel.
4. Distribution of promotional advertisements to appropriate individual (e.g. rewards, surveys, promos. etc.).
5. Sharing of individual’s data to third party providers/services which the user permitted.
6. Analyzing marketing strategy which may enhance product/service demand.
7. Accomplishing other tasks for processing or disclosure that is mandatory under a government’s law.  

c. What information is needed to be collected?

OCLP shall only collect personal information that is necessary for one or more of its functions and activities in a manner that is lawful, fair and reasonably unobtrusive. We shall only collect directly from individuals. Whenever necessary to collect information from a third party, we shall ensure proper advise and consent from the concerned individual.

When collecting personal information, we shall ensure that the individual is made aware of the identity of the OCLP personnel who is collecting the data, the purpose of collecting the data, the individual’s right to data access, and the consequences of the failure to disclose or provide the information.

d. Where we receive this information?

Personal information may be collected from different sources, including:

i. Information provided directly to us

• Purchase of our OCLP’s products or services
• Complaints, comments or inquiries lodged by individuals directly to OCLP
• Career application with the company
• Interaction with our sales or customer care agents, reservation officers or specialists, through e-mail, phone, chat services or face-to-face meetings
• Joining advertisement strategies like promos, rewards & loyalty program, raffles and others
• When you submit your personal information to us for any other reason

ii. Information collected when you connect to our network or visit our sites

• Purchase of our OCLP’s products or services
• Use of our networks whether Wi-Fi, mobile or other related channels
• Accessing to our websites, applications and other service channels.

iii. Information collected from other sources

OCLP may receive personal information from legitimate sources, including commercially or publicly sources such as public databases and published directories and public documents. We may also receive personal information from third parties provided that there is a given consent from concerned individual(s).  

By providing OCLP with your personal information in the use of any of our products and services as described in this policy, you have explicitly authorized and consented to our collection, use, access, transfer, storage and processing of said personal data.

 e. Personal information other than yours

When you disclose to us another person’s personal information (i.e. your dependent, spouse, children and/or parents), you attest that consent has been obtained from that person to disclose and process personal information in accordance with this policy.

f. Who we share this information with?

OCLP may share your personal information with the Ortigas Group of Companies and trusted third parties. We shall never share your information to other parties outside of our company unless there is a consent to provide your personal information or whenever required by law or legal process.

OCLP may share your personal information with companies, organizations, or individuals outside of the Ortigas Group of Companies if we deem it necessary to disclose information for legal reasons.

Any company with which we share information about you for the above purposes is contractually required to comply with confidentiality standards, undertake to respect any individual’s right to privacy and comply with the Data Privacy Act. We also require that these organizations use this information only for our purposes and follow our reasonable directions with respect to this information. This includes organizations which handle or obtain personal information including service providers for OCLP. 

g. International data transfers

Information that we collect may be stored and processed in and transferred between any of the countries in which we make use of cloud services (i.e. Office 365, Amazon Web Services, and the like) in order to enable us to use the information in accordance with this policy.

Personal information that you publish on our website or submit for publication on our website may be available, via the internet, around the world. We cannot prevent the use or misuse of such information by others.

h. How we secure your information?

OCLP shall take all necessary precautions in securing your personal information. All trusted third parties handling or processing your information shall likewise be required to do the same. To protect these information from unauthorized access, alterations or misuse, OCLP shall strictly implement the following security measures within the company:

1. Access to personal information shall be restricted to authorized users.
2. Personal information shall be protected using a secured server behind a firewall, data encryption and layered security controls.
3. Audit and testing of infrastructure equipment shall be regularly performed to guarantee data security.

i. Retention and disposal of your personal information

OCLP will retain documents (including electronic documents) containing your personal data:

1. To the extent that we are required to do so by law;
2. To the extent required by or pursuant to our contracts;
3. If we believe that the documents may be relevant to any ongoing or prospective legal proceedings in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk).

Thereafter, your personal information shall be disposed or discarded in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other party or the public.

j. We respect your rights as a data subject, which the DPA lists as follows:

1. You have the right to access information we hold about you, subject to providing us with appropriate evidence of your identity. We may withhold personal data that you request to the extent permitted by law.
2. You can object to us using your data for profiling you or making automated decisions about you.
3. You have the right to port your data in a mutually acceptable format.
4. You have the right for your data to be erased by asking us to suspend, withdraw, remove, or destroy your personal data, if it is no longer necessary for us to hold the data for the stated purposes (including for appropriate legal purposes).
5. You have the right to lodge a complaint regarding our use of your data; but please tell us first, so we have a chance to address your concerns. If we fail in this, you can address any complaint to the National Privacy Commission.
6. You have the right to damages arising from inaccurate, incomplete, false, unlawfully obtained or unauthorized use of your personal data

k. How can you check and update your personal information?

OCLP shall ensure that any concerned individual may update information securely to maintain data accuracy and relevance. Should there be a need to check or update your personal information, or if you wish to withdraw your given consent for any or all purposes set out in this Policy, you may get in touch with

Data Protection Officer

Ortigas & Company, Limited Partnership

7F, West Wing, Estancia Offices, Capitol Commons, Meralco Avenue, Pasig City

Email: oclp.dpo@ortigas.com.ph 

Depending on the nature of your consent withdrawal, OCLP may no longer be in a position to continue to provide products and services to you.

l. Management and Security

A Data Privacy Officer has been designated for OCLP and corresponding Compliance Officers of Privacy for our subsidiaries, if necessary, shall be appointed to manage and safeguard the handling of your personal information in compliance to the Philippine Data Privacy Act of 2012 or R.A. 10173 and this Policy. OCLP Management is committed to ensure that its Privacy Management Program is constantly reviewed, monitored and enhanced. OCLP regards personal information breaches very seriously.

m. Policy Updates

In compliance with the laws and regulations, OCLP may change this policy as necessary. We shall provide notice of any material change, and shall obtain your consent if required by law.