ASA Philippines Foundation, Inc. (“ASA Philippines”, “company”, “us”, or “our”) is dedicated to safeguarding the privacy of your personal data in accordance with Republic Act No. 10173, commonly known as the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulations, and all related issuances of the National Privacy Commission (“NPC”).

This Privacy Notice outlines our policy in collecting, using, and processing personal data, including information transmitted to us in the course of official transactions and gathered from you through our alternative channels, such as, but not limited to, publicly accessible data processing systems and notifications displayed at our reception area during events where the participants’ personal data is/are collected through attendance sheets or registration forms, as required by the NPC. This Privacy Notice is also applicable to any processing of personal data that is performed when you interact with us on our official website www.asaphil.org.

The terms of this Privacy Notice cover all our operations in our branches in the Philippines. Your personal information controller is ASA Philippines. In other words, ASA Philippines is responsible for collecting, processing, and protecting your personal data.

PERSONAL INFORMATION COLLECTED

Personal information is any recorded information from which the identity of an individual isapparent or can be reasonably and directly ascertained by the entity holding the information,or when put together with other information would directly and certainly identify an individual.

The information we collect from you, when you submit your inquiries or requests to us,whether manually or electronically, including the information transmitted through our “ContactUs” page, the form used to submit inquiries and concerns to us, may include:

From Contact / Inquiries

• Name
• Email address

From “Join Us” submissions

• Facebook name
• Full name
• Contact number
• Email address
• Address
• Job experience
• Academic background
• Civil status
• Health status

Other information collected for products/services

• Photo
• Previous last name (for married clients)
• Date of birth / Age
• Civil status, birthplace
• No. of family members
• Business type
• Mother’s maiden name / Father’s name
• PhilSys No., TIN, government IDs, ID nos.
• Bank account details
• Family monthly income / expenses
• Address / Zip code / Contact number
• Facebook account
• Poverty level / Housing / Living conditions
• Family members working abroad / hiring workers / PWD
• Membership in Indigenous Cultural Community / IP group
• 4Ps / MCCT beneficiary status
• Educational attainment of head of family
• Signature / Thumbmark
• Spouse / Co-maker / Surety maker information
• Beneficiary information
• Credit data / Date of death (if applicable)
• Employee information (name, ID, email, mobile, birthdate, branch)

USES OF, PURPOSE AND BASIS FOR PROCESSING OF PERSONAL DATA

The collection of your personal information is necessary to help us develop, deliver, and improve our products and services, including the following:

• Fulfillment of transactions and purchase and/or availment of our products and services;
• Documentation and processing of inquiries and requests addressed to ASA Philippines,
  ensuring proper forwarding to the relevant internal units for action, and response;
• Solicitation of the feedback for the products and services we offer;
• Fulfilling legal obligations imposed on ASA Philippines;
• Promoting the products and services of ASA Philippines;
• Complying with public order and safety requirements or performing public authority
  functions, including processing personal data to fulfill ASA Philippines’ charter; and/or
• Facilitating appropriate actions in response to data subjects’ requests related to their
  data privacy rights.

The personal data collected from you is necessary for the fulfillment of your transaction with usand pursuant to our legitimate interests, in consonance with our organizational charter.

OTHER USES OF PERSONAL INFORMATION

From time to time, we may use your personal information to send important notices and advisories, such as communications about the services that you may have availed and ongoing promotions. We may also use your personal information for internal purposes, such as auditing, data analysis, and research to improve our products, services, and customer communications.

MANNER OF STORAGE OF PERSONAL INFORMATION

We store your personal information on our computers and servers maintained in a secure environment and protected by the appropriate encryption protocols and authentication controls, which are designed to manage and restrict access strictly to authorized personnel.

Your personal information may likewise be stored with third-party data storage providers using cloud-based services, which is similarly protected by the appropriate encryption protocols and authentication controls. We commit to implementing appropriate measures to safeguard your information.

ACCESS TO COLLECTED PERSONAL INFORMATION

You are also made aware that we, including our affiliates, employees, agents, and third-party service providers (payments and data analytics), may access and share this personal information with each other and use it consistently with the purpose of your availed services and with the terms of this Privacy Notice.

For your guidance, the personal data which we process is not shared with any other party
unless such disclosure is allowed under Sections 12 or 13 of the DPA, whichever is applicable.

RETENTION AND DISPOSAL OF YOUR PERSONAL INFORMATION

Personal data will be retained in our secure database for a duration of two (2) years after the last transaction or resolution of inquiries and requests, or until the expiration of the retention limits set by applicable laws, whichever comes later. These records shall thereafter be permanently deleted in accordance with our disposal policy.

Where applicable, when it is no longer reasonably required for the above-related purposes or when you withdraw your consent (where applicable), provided that we are not legally required or otherwise permitted to continue to hold such data, we likewise commit to permanently delete your personal data in accordance with our disposal policy.

All documentation of personal information shall be permanently deleted after the lapse of the retention period. Additionally, once permanently deleted, your personal information cannot be recovered.

PROTECTION OF YOUR PERSONAL INFORMATION AND RISKS OF PROCESSING

Our company takes your privacy seriously and shall implement appropriate organizational, physical and technical security measures in our systems in order to maintain the highest levels of security and protection, which likewise undergo upgrading when necessary. When in transit, digital information shall be protected using encryption and authentication. These security measures aim to maintain the availability, integrity, and confidentiality of personal data and
protect them against natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destructions, alteration, and
contamination.

Please note however that no data transmissions in store can be guaranteed as 100% secure. Your own conduct may dictate your level of protection. As such, we cannot guarantee the security of any personal information you transmit to us. You understand that any personal information that you transfer to us is done at your own risk, specifically risks that are associated with personal data processing, such as targeted cyberattacks, malware, ransomware, computer viruses, or unauthorized access to manual records.

Our employees will also operate and hold personal data under strict confidentiality and shall ensure security of personal data. Additionally, comprehensive policies are in effect to ensure proper security incident management, aligning with established ASA Philippines policies, circulars, and other directives.

DATA PROTECTION AND SECURITY MEASURES

Our company ensures the confidentiality, integrity, and availability of your personal information through a combination of organizational, physical, and technical security measures in line with Republic Act No. 10173 and widely accepted data privacy and information security standards. Some of the measures we put in place include:

• Access control policies implemented in both digital and physical infrastructures to
  prevent unauthorized access to personal information;
• Acceptable use policies;
• Application of end-to-end encryption and data classification, whenever appropriate;
• Implementation of security measures to mitigate risks related to natural disasters,
  power disturbances, external access, and similar threats; and
• Employment of technical measures to safeguard our computers and databases against
  accidental, unlawful, or unauthorized usage, interference, or access.

METHODS UTILIZED FOR AUTOMATED ACCESS

You also understand that ASA Philippines employs a third-party service provider to analyze the data traffic on our website in order to aid our assessment of our website engagement and to enhance our services and features. For this objective, we refer you again to the data related to web traffic that is processed:

• Your IP address
• The pages and internal links accessed on our site
• The date and time you visited the site
• Geolocation
• The referring site or platform (if any) through which you accessed this site
• Your operating system
• Web browser type

This entity is obligated to protect your personal information. The utilization of cookies is involved in this service, and any data generated is not shared with any external parties.

INQUIRIES

Email: dpo@asaphil.org

EXERCISING YOUR RIGHTS OVER YOUR PERSONAL INFORMATION

We recognize that you are accorded rights over your personal data pursuant to the Data Privacy Act, such as but not limited to the right to access, right to rectification, right to object, right to erasure/blocking of personal information, right to be informed of the existence of processing of personal information, right to data portability, as well as the right to seek redress from the NPC should
there be a clear violation of your right(s).

In order to exercise these rights, you are free to amend, add, and update your personal information by informing our staff. You are also free to request for the deletion and disposal of your personal information by informing us of such request. You may also directly liaise with our Data Protection Officer for other concerns regarding your personal data and your rights through the contact information provided below.

CHANGES AND/OR UPDATES TO THIS PRIVACY POLICY

Our company may amend this Privacy Notice at any time and at its own discretion. Any changes, additions, deletions, amendments, or modifications to this Privacy Notice shall be posted at our physical stores. We encourage you to frequently check our policy to see any changes or updates.