Privacy Policy
We respect your privacy.
We are committed to protect and respect your personal data,
guided by the relevant provisions of data privacy laws and
regulations.
The following provides an overview of how your privacy is
respected and protected on this website:
What information do we gather?
With your informed consent, we collect the following
personal data in our website:
Category of Personal Data
|
Specific Personal Data Collected
|
1. Personal Details |
First Name, Last Name. |
2. Contact Details |
E-mail Address, Phone Number |
3. Usage Data / Cookies* and geolocation data
|
Internet Protocol Address (IP Address), browser type,
browser version, the pages of the website visited, the
time and date of visit, the time spent on specific
pages of the website, unique device identifiers and
other diagnostic data.
|
* Cookies are text files containing small amounts of
information which are downloaded to your computer or
mobile device when you visit a site and allow a site to
recognize your device.
If you are uncomfortable regarding the use of cookies, you
can disable cookies on your computer by changing the
settings in the preferences or options menu of your browser.
For which purposes and on which legal basis do we use
your personal data?
We use your personal data only where required for specific
purposes. The list of purposes and the corresponding legal
basis for the collection of your personal data are outlined
in the table below:
Personal Data Collected
|
Purpose |
Legal Basis |
1. Personal Details and Contact Details
|
Facilitating communication with you |
Justified on the basis of our legitimate interests for
ensuring proper communication and to address properly
your inquiry or concern.
a) Justified on the basis of our legitimate
interests for ensuring that you receive an excellent
user experience, and our networks and information
are secure.
b) Justified on the basis of our legitimate
interests for ensuring that we only show you content
based on the consent you provided.
|
2. Usage Data / Cookies and geolocation data
|
Improving the security and functionality of our
website, networks, and information; analyze traffic,
enable social media functionality, and offer you
marketing content and advertisements according to your
interests.
|
What about sensitive personal data?
We do not seek or collect or otherwise process sensitive
personal data through this site. Where it becomes necessary
to process your sensitive personal data for any reason, we
rely on your prior express consent for any processing which
is voluntary (e.g., for marketing purposes). If we process
your sensitive personal data for other purposes, we rely on
the following legal bases: (i) detection and prevention of
crime (including the prevention of fraud); (ii)
establishment, exercise, or defense of legal claims; and
(iii) compliance with applicable law.
How do we collect your personal data? (“Manner of
Collection of Personal Data”)
Directly through the contact form in our website which will
ask for your personal information together with your inquiry
or concern.
We also collect your personal information indirectly through
usage data (i.e. internet access logs) or cookies (Please
see Part I and II of this Privacy Policy).
When you access the ADEC Innovations website, your Internet
address is automatically collected and placed in our access
logs. One way we collect information is through the use of
cookies. Cookies are small files that save and retrieve
information about your visit to the ADEC Innovations website
such as how you entered and navigated through our site. The
cookies we use identify you by number, not by name.
Do we share your information with third parties?
(“Disclosure of Personal Data to Third Parties”)
As a global organization, we may share your information with
employees of ADEC Innovations and third party-stakeholders
of our company, but only to the extent necessary to address
your inquiry or concerns. Such third party-stakeholders may
be located in other countries.
Before we do so, we shall take the necessary steps to ensure
that your personal data will be given adequate protection as
required by relevant data privacy laws in the Philippines
and in the territory of the third party, as well as in
accordance with ADEC Innovations’ internal policies.
We also share your information through our third-party cloud
service provider, where your personal data are stored in
accordance with our instructions as Personal Information
Controller (PIC) and within the retention limits set by our
company. (see Part VI- Storage and Transmission of Personal
Data and Part VII – Retention of Personal Data of this
Privacy Policy).
How do you store and transmit personal information?
(“Storage and Transmission of Personal Data”)
A. Storage
-
We use a third-party cloud-based CRM platform to store the
personal data collected.
-
A unique account is registered through the CRM platform,
which is administered by our designated Customer
Relationship Management (CRM) Administrator. This unique
account is secured through a username and password known
only to the CRM Administrator.
-
The data collected from our website through the form found
therein are automatically transmitted to the third-party
CRM platform.
-
In addition to the storage in the third-party cloud-based
CRM platform, we store in an encrypted back up in our
company secure local server.
B. Transmission
-
Any personal data we collected is automatically
transmitted to our third-party cloud-based CRM platform.
-
Any personal data collected is likewise transmitted to our
employees who may have a legitimate interest over the
personal data, upon a written request by e-mail. The CRM
Administrator transmits encrypted personal data by e-mail.
How do you store and transmit personal information?
(“Storage and Transmission of Personal Data”)
We retain your data for a maximum of two (2) years, after
which we delete or dispose of the same in accordance with
our personal data disposal or deletion policy.
Disposal of Personal Data Collected
Disposal of Personal Data Collected in our website through
our third-party storage platform and our back-up stored in
the CRM Administrator’s computer/laptop is done after two
(2) years from collection or upon request of the data
subject. Should we need to retain your data for a longer
period, you will be notified accordingly.
Our Data Privacy Compliance Office (DPCO) and DPOs monitor
and audit respective personal data’s maturity, collected and
stored and ensure that data reaching maturity of retention
period shall be reviewed for usefulness and disposed of
accordingly, following the company policies and procedures
in disposal of personal data, to wit:
(a) Our CRM Administrator is the person mainly responsible
to delete personal data upon its maturity or request of the
data subject. As a policy, all personal data collected in
our website are in digital format. These are deleted through
the third-party cloud-based CRM Platform by the CRM
administrator. A written report of deletion of personal data
(with details of the deletion, such as date, time and place
of deletion, persons present, manner of deletion and
description of the personal data deleted), shall be
accomplished by the CRM Administrator for submission to the
DPO.
(b) Our third-party cloud-based storage provider is also
notified through a request to be made by the CRM
Administrator of the maturity of the personal data collected
and/or the request made by the data subject, with an
instruction that the same should be deleted permanently from
their system. A written report shall be required of the
third-party cloud-based storage provider, with details of
the deletion, such as date, time and place of deletion,
persons present, manner of deletion and description of the
personal data deleted.
(c) As to the back-up copy of the personal data collected
stored in the laptop/computer of the CRM Administrator, the
same are deleted in the same manner as letter (a) hereof.
Security Measures to Protect your Personal Data
We take appropriate steps to maintain the security of your
data on the ADEC Innovations website.
We are implementing organizational, physical, and technical
security arrangements for all the personal data we hold. We
have protocols, controls and relevant policies, procedures,
and guidance to maintain these arrangements taking into
account the risks associated with the categories of personal
data and the processing we undertake.
We adopt organizational and market leading security measures
and technology, and maintain annual certifications by
leading authorities in compliance, in order to protect your
personal data, including but not limited to:
A. Organizational Measures. Our company has appointed a Data
Protection Officer (DPO) and Compliance Office (COP) to
ensure compliance with DPA. We also ensure that all our
employees are equipped with knowledge on DPA, through
internal and external trainings and seminars. Our company
conducts Privacy Impact Assessment (PIA), especially for our
teams who handle the company’s website, to ensure that
personal data is protected at all times.
Access to personal data collected through our website are
granted only to authorized personnel. Each personnel with
access to personal data shall verify his or her identity
using a secure encrypted link and multi-level
authentication.
We ensure that a data sharing agreement, with specific
provisions on security measures to protect your data is
executed with our service providers, including our
third-party cloud-based service storage provider.
B. Physical and Technical Security Measures. The personal
data collected through our website are all in digital
format. Hence, we do not print collected data, nor do we
retain paper-based or hard copies thereof.
-
-
We review and evaluate software applications before
its installation in computers and devices owned by the
organization to ensure compatibility of security
features with the overall operations, including the
third-party cloud-service storage we use to store the
personal data collected through our website.
-
We review security policies, conduct vulnerability
assessments and perform penetration testing within the
company on a regular schedule to be prescribed by our
BTS & InfoSec department.
-
Encryption, authentication process, and other
technical security measures that control and limit
access to personal data are implemented. All files
with personal data collected are password-protected
and may only be accessed by authorized personnel.
A full and comprehensive procedure of these Security
Measures is available upon request.
-
We also subscribe to the following globally recognized
Quality Management Standards (ISO/IEC 9001) and
Information Security Management Standards (ISO/IEC 27001)
and conform to globally accepted best practices, to ensure
personal data remain safe and secured while it is
processed with transparency, legitimacy and
proportionality to preserve its confidentiality, integrity
and availability, thereby upholding the data privacy
rights of our employees, customers and business
stakeholders. Our organization remains compliant and
ensures updated certification for ISO 9001, ISO 27001 and
ISO 14001; and implements reasonable and appropriate
measures to protect personal data against natural dangers
such as accidental loss or destruction; and human dangers
such as unlawful access, fraudulent misuse, unlawful
destruction, alteration and contamination:
-
ISO/IEC 27002, Information Technology – Security
Techniques—Code of Practice for Information Security
Controls;
-
ISO/IEC 27003, Information Technology- Security
Techniques – Information Security Management System
Implementation Guidance;
-
ISO/IEC 27005, Information Technology – Security
Techniques – Information Security Risk Management;
-
ISO/IEC 29134, Information Technology – Security
Techniques—Guidelines for Privacy Impact Assessment;
-
ISO/IEC 29151, Information Technology – Security
Techniques—Code of Practice for personally
identifiable information (PII) protection;
-
ISO/IEC 29100, Information Technology – Security
Techniques – Privacy Framework;
-
ISO/IEC 3100:2018 Guidelines on Risk Assessment; and
-
ISO/IEC 27018:2014 Information Technology- Security
Techniques—Code of Practice for protection of
personally identifiable information (PII) in public
clouds acting as PII processors.
While we use reasonable technical and administrative
measures within our means to protect your data against
unauthorized or unlawful use, processing, accidental loss,
alteration, disclosure or access, accidental or unlawful
destruction or damage thereto, you must understand that the
open nature of the Internet is such that data may flow over
networks without security measures and may be accessed and
used by people other than those for whom the data is
intended. Thus, please remember that no method of
transmission over the Internet, or method of electronic
storage is 100% secure and while we strive to use
commercially acceptable means to protect your personal data,
we cannot guarantee its absolute security.
What are your rights in relation to the processing of
your personal data?
The following are your rights subject to limitations set by
law:
-
RIGHT TO INFORMATION This right entitles
you to know the specific personal data being collected,
the purposes for its processing.
-
RIGHT OF ACCESS This right entitles you
to know whether we hold personal data about you and, if we
do, to obtain information on and a copy of that personal
data.
-
RIGHT TO RECTIFICATION This right
entitles you to have your personal data be corrected if it
is inaccurate or incomplete.
-
RIGHT TO OBJECT This right entitles you
to object the processing of your personal data.
-
RIGHT TO ERASURE This right entitles you
to request the erasure of your personal data, especially
when it is no longer necessary to achieve the purposes.
-
RIGHT TO RESTRICTION OF PROCESSING This
right entitles you to limit the personal data to be
processed.
-
RIGHT TO DATA PORTABILITY This right
entitles you to receive a copy (in a structured, commonly
used, and machine-readable format) of personal data that
you have provided to us or request us to transmit such
personal data to another data controller.
Withdrawal of Consent. Right to Complaint and
Damages
To the extent that the processing of your personal data is
based on your consent, you have the right to withdraw such
consent at any time by contacting ADEC Innovations’ Data
Protection Officer. Please note that this will not affect
ADEC Innovations’ right to process personal data obtained
prior to the withdrawal of your consent, or its right to
continue parts of the processing based on other legal bases
than your consent.
If, despite our commitment and efforts to protect your
personal data, you believe that your data privacy rights
have been violated, we encourage and welcome you to first
seek resolution of any complaint. You have the right, at all
times, to register or file a complaint directly with the
relevant supervisory authority (the National Privacy
Commission) or to make a claim against us with a competent
court (either in the country where you live, the country
where you work or the country where you deem that data
privacy law has been infringed), with a right to seek
damages.
For any concerns and request to exercise the foregoing
rights, except those which are within the jurisdiction of
the NPC or a competent court, you may contact us at
dataprivacyoffice@adec-innovations.com.