I. DECLARATION OF POLICY
Pursuant to the policy of the state in recognizing the importance of free flow and exchange of information in nation building and organizational development, while ensuring the protection and security of data and information from any breach, the JTC Group of Companies hereby adopts this Data Privacy and Protection Policy to serve as a general written corporate policy in the collection, processing, management, sharing, organization, recording, updating, modification, storage and destruction of data, personal and sensitive personal information whether given in written form or stored in an Information and Communications Technology (ICT) system in compliance with Republic Act No. 10173, otherwise known as the “Data Privacy Act of 2012” and its Implementing Rules and Regulations.
II. OBJECTIVE
The objective of the adoption of this foregoing policy is to ensure that data and information obtained by JTC Group of Companies in all its commercial transaction and dealings is secured and protected from any unauthorized disclosure or breach, and to establish a uniform policy and rules of procedure in the collection, processing, management, sharing, organization, recording, updating, modification, storage and destruction of data and information in all levels of organization.
III. COVERAGE AND APPLICATION
This policy applies to all department, unit, employees, officers, directors, and agents of JTC Group of Companies engaged in the collection and processing of data and information, as well as its affiliates and subsidiaries.
This foregoing policy is intended to govern and manage the internal process and procedure of JTC Group of Companies on data and information collection, processing, management, sharing, organization, recording, updating, modification, storage, protection and destruction.
IV. DEFINITION OF TERMS
(a) Data Subject - refers to an individual whose personal information is processed.[1]
(b) Consent of the data subject - refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so. [2]
(c) Personal Information - refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.[3]
(d) Sensitive Personal Information – refers to personal information:
- About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
- About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
- Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
- Specifically established by an executive order or an act of Congress to be kept classified.[4]
(e) Processing - refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.[5]
(f) Personal information processor - refers to any natural or juridical person qualified to act as such under this Act to whom a personal information controller may outsource the processing of personal data pertaining to a data subject.[6]
[1] Sec. 3 (c) of R.A. 10173.
[2] Sec. 3 (b) of R.A. 10173.
[3] Sec. 3 (g) of R.A. 10173.
[4] Sec. 3 (l) of R.A. 10173.
[5] Sec. 3 (j) of R.A. 10173.
[6] Sec. 3 (i) of R.A. 10173.
Ⅴ. DATA AND INFORMATION COVERED
The following data and information being collected and processed by JTC Group of Companies, its affiliates and subsidiaries are covered under this corporate policy.
- Personal information of data subjects.
- Sensitive personal information of data subjects.
- Human Resource files, data and information on employees and applicants.
- Accounting books, ledgers and tax returns containing vital financial data and information.
- Banking records and transactions.
- Financial records and statements.
- Electronic data, motion pictures, closed-circuit television (CCTV) recordings, footages and property inventory.
- Processes, formulation, procedure and training design.
- Data and information stored in an Information and Communication (IC) system.
- Business operation models and design, including those model and design owned by a franchisor in a franchise agreement where JTC Group of Companies is a franchisee.
- Marketing design and techniques owned by JTC Group of Companies, including marketing design and techniques protected under a franchise agreement where JTC Group of Companies is a party.
- Systems owned by JTC Group of Companies, Inc., data, information, process, patent and marks protected under a confidentiality clause in a franchise agreement or any other commercial contracts belonging to another entity.
- Corporate books, records, transactions and securities (if applicable).
VI. DATA COLLECTION
JTC Group of Companies may collect information:
- Directly from data subjects when they register, submit forms, communicate with us, make purchases, or otherwise use our services.
- From their employer, organization, authorized representative, or other persons acting on your behalf, where legally permitted.
- Automatically through websites, applications, cookies, logs, and similar technologies.
- From service providers and business partners.
- From publicly available or government sources where permitted by law.
As a result of data and information collection, personal information and sensitive personal information such as a data subject’s name, age, gender, date of birth, place of birth, social status, family background, education, ethnicity, religion and cultural affiliation, taxpayer’s identification number (TIN), social security number, mobile number, e-mail address, etc. may be collected for the above-mentioned manner.
VII. DATA AND INFORMATION USAGE
JTC Group of Companies may collect and process personal and sensitive personal information for legitimate and lawful purposes, including:
- Processing of employment applications, including promotion and designation.
- Providing, maintaining, and improving our products and services;
- Processing transactions and payments;
- For timely communication about services, transactions, updates, and support;
- Identity verification to preventing fraud, unauthorized access, and abuse;
- Compliance with legal, regulatory, tax, and contractual obligations;
- Protecting the rights, property, safety, and security of our organization and others;
- Conduct internal administration, auditing, analytics, and business operations;
- External business partnerships, transactions and promotional engagements.
- Responding to requests, complaints, and inquiries.
- For other lawful purposes disclosed at the time information is collected or otherwise permitted by Philippine privacy laws.
VIII. DATA AND INFORMATION SHARING
Where consent is required, JTC Group of Companies, its affiliates and subsidiaries will obtain consent before collecting or processing personal or sensitive personal information. Consent may be withdrawn at any time, subject to legal or contractual limitations and the consequences explained at the time of withdrawal.
Withdrawal of consent will not affect the lawfulness of processing performed before the withdrawal.
JTC Group of Companies may also process information without consent if permitted or required by applicable law, such as to fulfill a contract, comply with a legal and contractual obligation, protect vital corporate interests, pursuant to a lawful order issued by judicial courts, procurement of third-party services such as insurance service, bank loan applications and other employee services, or to pursue a legitimate and lawful purpose.
IX. DATA PROTECTION AND SECURITY
In accordance with this foregoing corporate policy, JTC Group of Companies, all its department, units and offices shall maintain reasonable administrative, technical, and physical and electronic safeguards designed to protect personal and sensitive personal information against unauthorized access, collection, use, disclosure, alteration, loss, destruction, or other unlawful processing.
Security measures may include access controls, authentication procedures, encryption (where appropriate), security monitoring, employee confidentiality obligations and secured disposal procedures.
No method of transmission or storage can be guaranteed to be completely secure. If we become aware of a security incident affecting personal information, we will respond and provide notifications as required by Philippine privacy laws.
Data containing personal information and sensitive personal information collected, processed and stored by JTC Group of Companies in all its filing system, hardware and software, absent any claim from data subjects for rectification, reparation, damages or any violations under the Data Protection Act shall be destroyed and disposed of in a secured procedure within five (5) years from the exact date of collection.
Destruction and disposal of all data and information under this policy shall be done by acts of total physical destruction and obliteration, i.e., shredding, burning or physical disposal. Data and information stored electronically in a flash drive or any hardware shall be destroyed and disposed of by complete deletion, including any back-up files or memory pertaining to such data and information.
X. REQUEST OF DATA AND INFORMATION
Request and processing of data and information containing personal information and sensitive personal information of a data subject from an external client or individual shall be in writing, stating among others, the kind of data and information requested, the person, organization or corporation requesting such data or information, purpose of the request, extent of the intended usage. All external written request received thereof shall be referred to the office of the Junior Legal Counsel for review and assessment to determine whether the request falls under the permitted instances where data and information of a data subject may be validly disclosed or shared under Sections 11 and 12 of R.A. 10173. If the nature and purpose of the request does not fall under the permitted exceptions, the same shall be denied outright.
In no case shall data or information be disclosed or shared without obtaining the prior written consent of the data subject, after a lawful determination of the validity of the request.
Inter-department request within the organization of data and information containing personal information and sensitive personal information shall also be in writing following the procedure of the two immediately preceding paragraph. Request of data and information other than personal information and sensitive personal information covered under Clause V of this policy under the possession and custody of the department heads shall also be in writing.
XI. APPOINTMENT AND DESIGNATION OF DATA PROTECTION OFFICER
Should JTC Group of Companies register as a Data Processing System (DPS) organization which regularly acts as Personal Information Processors (PIPs) and Personal Information Controllers (PICs) in all its transactions shall designate and appoint a Data Protection Officer (DPO) and register with the National Privacy Commission (NPC).
XII. DATA SUBJECT PRIVACY RIGHTS
Data subjects whose personal information and sensitive personal information are being collected under Clause VII of this policy shall have the following rights in compliance with Section 16[7] of R.A. 10173:
- Right to be informed whether personal information pertaining to him or her shall be, are being or have been processed.
- Right to access the personal information and sensitive personal information pertaining to him/her.
- Right to object on any error, inaccuracy, mistake in the handling and processing of data and information of a data subject.
- Right to rectify any error, inaccuracy or mistake on any essential details.
- Right to be indemnified for any damages caused by any error, inaccuracy, mistake, false or unauthorized disclosure of personal and sensitive personal information.
[7] Chapter IV “Rights of the Data Subject”, R.A. No. 10173.
XIII. GOVERNING LAW AND REGULATIONS
This policy shall be primarily governed by the provisions of Republic Act No. 10173, otherwise known as the “Data Protection Act of 2012” and its Implementing Rules and Regulations, as well as circulars, policies and general instructions issued by the National Privacy Commission (NPC). Any clause(s) herein found to be non-compliant, or in violation of any of the provisions of the Data Protection Act of 2012 and other privacy laws shall be deemed null and void. Other clause(s) and provisions, insofar as it complies and not inconsistent with the provisions of the Data Protection Act of 2012 shall continue to be in force and effect.
XIV. AMENDMENT, MODIFICATION AND REVOCATION
JTC Group of Companies, Inc., in its prerogative, may amend or modify this policy, or any part thereof without prior written notice, provided that any amendment or modification shall comply with the provisions of the Data Protection Act of 2012. Should the law mentioned herein be repealed or totally abrogated by act of Congress resulting to total incompatibility of this policy to the repealing law or any part thereof, this policy shall automatically be revoked or totally abrogated, as the case may be.
Any amendment, modification or alteration to this original policy after its approval and issuance shall be by a controlled order document showing the clause, provision or any part thereof being amended or modified.
For the information and guidance of all concerned.
Prepared by:
ATTY. ADRIAN B. HERNANDEZ
Junior Legal Counsel
JTC Group of Companies
Recommending Approval:
RICCI EVETTE L. CRUZ
Vice-President
Approved/Disapproved:
DR. JAIME T. CRUZ
President and CEO
Copy furnished: All Department Heads