PRIVACY POLICY

1. Information We Collect

Kompanya.ph ("we," "us," or "our") is a job matching and recruitment platform serving Filipino workers across all sectors. As a Personal Information Controller (PIC) under the Data Privacy Act of 2012 (DPA), we ensure that the collection of your personal data adheres to the principles of:

• Transparency: You are informed of what data we collect and why;
• Legitimate Purpose: Data is collected only for declared, specified, and legitimate purposes;
• Proportionality: Collection is adequate, relevant, and not excessive for the intended purposes.

1.1 Personal Information You Provide (Job Seekers)

• Identity & Contact Data: Full name, email address, phone number, date of birth, and home address (used for localization of job matches and compliance with the Labor Code of the Philippines (PD 442)).
• Government-Issued Identifications: In compliance with Republic Act No. 10917 (amending the Public Employment Service Office Act) and pre-employment verification requirements, we may collect UMID, PhilHealth, SSS, Pag-IBIG, TIN, or passport numbers solely for identity verification and to facilitate compliant hiring processes.
• Professional & Employment History: Resume/CV, employment history (including reasons for separation), educational background, skills, training certificates, and professional licenses (e.g., PRC ID). This data is essential for accurate job matching and employer verification.
• Health & Safety Data (with Consent): If required by the employer, particularly in construction, manufacturing, healthcare, or other regulated sectors, we may collect pre-employment medical information in accordance with the Occupational Safety and Health Standards (OSHS) and the Labor Code, provided we obtain your explicit consent.

1.2 Information You Provide (Employers & Recruitment Agencies)

• Business Information: Company name, SEC/DTI registration number, business address, and contact details for verification under the Labor Code's requirements for legitimate recruitment activities and to prevent illegal recruitment practices.
• Authorized Representative Data: Name, position, contact number, and a valid government ID of the person authorized to post job openings and access applicant data on behalf of the company.

1.3 Information Automatically Collected (System Data)

• Usage Data: Pages visited, job searches, applications submitted, time spent on platform—used to improve our matching algorithms and detect fraudulent activities.
• Device & Technical Data: IP address, browser type, operating system, device identifiers, and approximate location. We do not collect precise geolocation without your explicit permission.

2. How We Use Your Information

Your personal data is used strictly for the following declared and legitimate purposes, in compliance with the Data Privacy Act and other relevant Philippine laws:

• Job Matching & Application Facilitation: To connect you with legitimate employers and accredited recruitment agencies, ensuring a secure and efficient hiring process in line with the Labor Code of the Philippines (Presidential Decree No. 442) and its implementing rules.
• Pre-Employment Verification: To verify your identity, educational background, employment history, and professional licenses to ensure the integrity of the hiring process and comply with employer requirements.
• Regulatory Compliance: To submit required reports to government agencies including the Department of Labor and Employment (DOLE), the Philippine Overseas Employment Administration (POEA), the Bureau of Internal Revenue (BIR), and other regulatory bodies when mandated by law or when you apply for overseas employment opportunities.
• Platform Improvement & Security: To analyze usage trends, enhance job matching accuracy, and protect our platform against unauthorized access, identity theft, and other cybersecurity threats.
• Communication: To send you job alerts, application status updates, platform announcements, and relevant employment opportunities. You may manage your notification preferences at any time through your account settings.
• Fraud Prevention: To detect and prevent fraudulent activities, illegal recruitment practices, and unauthorized access to our platform.

3. Sharing & Disclosure

Kompanya.ph respects your privacy and does not sell your personal information. We share your data only in the following circumstances, in strict compliance with the Data Privacy Act and other applicable laws:

3.1 With Employers & Recruitment Agencies

When you apply for a job or opt-in to be discovered by employers, your profile information is shared only with the specific employer or accredited recruitment agency you have engaged with. For overseas employment opportunities, we may share your data with the Philippine Overseas Employment Administration (POEA) and foreign principals as required by law and to ensure compliant deployment.

3.2 With Third-Party Service Providers

We engage third-party processors for essential services such as cloud hosting, analytics, customer support, and background verification services. These processors are contractually bound through Data Processing Agreements to implement appropriate security measures and process data only on our instructions, in compliance with the DPA's requirements for outsourcing (NPC Circular No. 16-03).

3.3 With Government Agencies & Legal Authorities

We may disclose your personal data when required by law, court order, or lawful request from government agencies, including but not limited to the National Privacy Commission (NPC), DOLE, POEA, BIR, National Bureau of Investigation (NBI), and Philippine National Police (PNP), to comply with legal obligations, protect our rights, or ensure the safety of our users.

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, or asset sale, your personal information may be transferred as part of the transaction. We will notify you of any such change and ensure that the receiving entity is bound by data protection obligations at least as stringent as those contained in this Privacy Policy.

4. Your Privacy Rights (Under the Data Privacy Act of 2012)

As a data subject in the Philippines, you are entitled to the following rights under Republic Act No. 10173, Sections 16–18, and NPC Circular No. 16-03:

• Right to be Informed (Sec. 16a): You have the right to be notified before your personal data is processed, including the purpose, scope, and method of processing.
• Right to Access (Sec. 16b): You may request a copy of your personal data processed by Kompanya.ph, free of charge once a year, including information on how your data has been used and shared.
• Right to Rectify (Sec. 16c): You may dispute any inaccuracy or error in your personal data and have it corrected immediately and without cost.
• Right to Erasure or Blocking (Sec. 16d): You may request the deletion or blocking of your personal data when it is no longer necessary for the purposes for which it was collected, when consent is withdrawn, or when processing is unlawful.
• Right to Object (Sec. 16e): You may object to the processing of your personal data, particularly for direct marketing, automated processing, or when processing is based on legitimate interests.
• Right to Data Portability (Sec. 16f): You have the right to obtain a copy of your personal data in an electronic format that is structured, commonly used, and machine-readable, to be transmitted to another data controller.
• Right to Damages (Sec. 16g): You may claim compensation for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized processing of your personal data.
• Right to File a Complaint: You have the right to lodge a complaint with the National Privacy Commission if you believe your privacy rights have been violated.

To exercise these rights, please email our Data Protection Officer (DPO) at sales@agmstech.com. We will respond to verified requests within 15 calendar days from receipt, as prescribed by NPC Circular No. 16-03. For requests involving complex matters, we may extend the period by an additional 15 days, providing written notice of the extension.

5. Data Security & Breach Protocol

We implement organizational, physical, and technical security measures to protect your personal data against accidental or unlawful destruction, alteration, disclosure, and access, in compliance with the NPC's Security of Personal Data (Circular 17-01):

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 (Transport Layer Security).
• Access Control: Strict role-based access controls are implemented. Only authorized personnel with a legitimate need-to-know can access user data, and all access is logged and audited.
• Regular Audits: Annual security audits, vulnerability assessments, and penetration testing are conducted by independent third-party security firms to ensure ongoing compliance.
• Secure Storage: Data is stored in ISO 27001-certified data centers located in the Philippines and in jurisdictions compliant with cross-border transfer requirements under the DPA.
• Employee Training: All employees undergo mandatory data privacy and security awareness training annually.

Data Breach Response

In the event of a personal data breach, we will comply with the NPC Breach Reporting Guidelines (Circular 18-03). We will notify the National Privacy Commission and affected data subjects within 72 hours upon knowledge of the breach, or as soon as reasonably practicable, providing details of the breach, its impact, and the mitigation measures taken to prevent further harm.

While we strive to implement the highest security standards, no system is 100% secure. Please notify us immediately at sales@agmstech.com if you suspect any unauthorized access to your account or personal data.

6. Data Retention & Disposal

We retain your personal data only for as long as necessary to fulfill the declared purposes, or as required by applicable Philippine laws and regulations. Our retention schedule is guided by the DOLE Department Order No. 180-17 (Implementing Rules and Regulations of the Labor Code), the DPA's Retention Period Guidelines, and other relevant legal frameworks:

• Active Accounts: Data is retained while your account is active to provide continuous job-matching services and to maintain your application history.
• Inactive Accounts: Accounts with no login activity for 24 consecutive months will be flagged for review. We will notify you via email at least 30 days before deactivation. If no response is received, your data will be anonymized or securely deleted after a 30-day grace period.
• Employment Records: Data related to successful job placements (e.g., employment contracts, onboarding documents) may be retained for 5 years after the end of the engagement to comply with the Labor Code's prescription periods for money claims (Article 306 [291]) and other legal obligations.
• Transaction Records: Financial records and transaction logs related to premium services are retained for 10 years in compliance with BIR regulations and the Corporation Code.
• Deleted Accounts: Upon account deletion, your data will be scheduled for secure disposal within 30 days, except where retention is required by law or for legitimate business purposes (e.g., unresolved disputes, fraud investigations).

Data disposal is performed using secure methods that render the information irrecoverable, including digital shredding, degaussing, or physical destruction of storage media as appropriate.

7. Contact Us & Our Data Protection Officer (DPO)

For privacy-related concerns, to exercise your rights, or to report a potential data breach, you may contact our Data Protection Officer (DPO), appointed in compliance with the DPA and NPC Circular 16-04. The DPO serves as the point of contact for data subjects, the National Privacy Commission, and other stakeholders.