DATA PRIVACY POLICY

San Buenaventura Power Ltd Co. (SBPL), respects your privacy and recognizes the need for appropriate measures to protect and manage your personal data entrusted to us. Our Privacy Policy follows, and is consistent with, the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), other issuances of National Privacy Commission (NPC), as well as other relevant laws of the Philippines.

Personal data refers to all types of personal information, sensitive personal information and privileged information. Personal information refers to “any information, whether or not recorded in any form, from which the identity of an individual is apparent or can reasonably and/or directly be ascertained by the entity holding the information, or, when put together with other information, would directly and certainly identify an individual”.

This Privacy Policy pronounces how SBPL process (how it collects, uses, shares, and keeps) and protect your personal data. It also provides the steps that you can take should you wish for any change in how we use your personal data, or if you want us to stop using your personal data.

Why do we collect your personal data?

To enable us to comply with our corporate policies in relation to data subjects as well as with the requirements under the Data Privacy Act, it is important that we collect, use, store and retain your personal data only as is reasonable and necessary for a declared and specific purpose stated in the pertinent consent forms.

In general, we are using your data for any of the following purposes:

• To comply with obligations under law and as required by government organizations and/or agencies;
• For performance of business function such as approvals, reviewer, signatories;
• To perform such other processing or disclosure that may be required under law or regulation;
• To comply with the requirements of audit and privacy compliance assessments/review.

Other uses by nature of our transactions

In addition, from the general uses mentioned above, we may use your personal information depending on your transactions with us in any of the following means:

• When you are a vendor, a potential vendor, contractor, buyer, a consultant:
• For accreditation as our vendor;
• To enroll details in SBPL system and apply changes;
• To evaluate qualifications for engaging consulting services;
• To enable us to process our payment for your products and/or services in accordance with the agreement;
• To facilitate the execution of deeds of sale, deeds of donation, MOAs, and MOUs.

What type of personal data do we collect?

The common type of data collected by SBPL from you, generally includes the following:

• Personal information such as full name, date of birth, home address, e-mail address, telephone, other personal contact numbers;
• Sensitive personal information such as nationality, marital status, gender, health, education, family background (including names of spouse, parents, or children and their dates of birth, government issued identification documents which include, but are not limited to identity (ID) cards, licenses, social security number, taxpayer identification number, passport number, driver’s license number, community tax certificate, police clearance;
• Employment record such as educational background, employment history, certifications, and trainings attended, resume and income information of your previous jobs; and character references (including names, address, and contact details).

You are responsible for ensuring that all data, whether personal information, sensitive personal information or privileged information, you submit to SBPL is accurate, complete and up-to-date.

How we collect, acquire or generate your data?

We collect data when you:

• Fill-up our official forms;
• Submit Supporting Documents;
• Encode your data in our applications and other official forms;
• Disclose your personal information through phone calls, emails, SMS or verbal communication with our authorized representatives; and,
• Through third parties such as: job-search engines, hospitals and clinics that provide results of pre-employment medical and Annual Physical Exam results; agencies, service providers, contractors, existing suppliers, customers, former employers, PICPA, PRC, and other professional associations;

We generate data when:

• We encode your data in our Excel databases and applications;
• You accept and sign an agreement, deed or a contract with us;
• You participate in our activities such as public biddings;
• You become a beneficiary of one of our CSR Programs like Scholarship Program, Medical Outreach Program, Cataract and Pterygium Operation, OJT Program and Hoop Camp.

Do our websites use web analytics?

All our websites engage third-party service providers to analyze the web traffic data for us. This service does use cookies or web beacons.

Cookies are small files that our website puts on your personal computer (PC) to store information about your preferences. Cookies can improve your browsing experience by allowing our website to remember your preferences or letting you avoid signing in each time you visit our website. If you don’t want our website to store cookies on your PC, you can block cookies. But blocking cookies might prevent some pages from displaying correctly, or you might get a message from our website letting you know that you need to allow cookies to view our website.

For you to fully enjoy your visit and browsing experience, only non-identifiable web traffic data are collected and analyzed, including:

• Your internet protocol (IP) address;
• The search terms you used;
• The pages and internal links accessed on our site;
• Demographics (limited to the date and time you visited the site, including frequency of visits)
• Geolocation;
• Your operating system; and
• Web browser type.

Use the options in your web browser if you do not wish to receive cookies or you wish to set your browser to notify you when you receive cookies. Click on the “Help” section of your browser to learn how to change your cookie preferences. If you disable all cookies, you may not be able to take advantage of all the features of this website.

What about the links to third-party websites?

From time to time, we will provide links to third-party web sites, or advertisements which contain links to third-party sites. These links are provided as a service to you and we do not provide any personal data to these websites or advertisers, and therefore, we will not accept responsibility for their privacy practices. These sites are operated by independent entities that have their own privacy policies which you should review as well. SBPL’s Privacy Policy does not apply to such other sites or to the use that those entities make of your information. SBPL has no control over the content displayed on such sites, nor over the measures, if any, that are taken by such sites to protect the privacy of your information.

Who we share your personal data with?

As a general rule, we are not allowed to share your data to third party except in limited circumstances as listed below.

By giving your consent, you authorize SBPL to disclose your personal data to accredited/affiliated third parties or independent/non-affiliated third parties, whether local or foreign in any of the following circumstances:

• As necessary for the proper execution of processes related to the purposes declared in this Privacy Policy.
• The use or disclosure is reasonably necessary, required or authorized by or under law (such as for criminal investigation, as requested by court of law).

This means we might provide your personal data to the following:

• Our affiliates, subsidiaries, partner companies, organizations, or agencies including their sub-contractors or prospective business partners that act as our service providers and contractors;
• Law enforcement and government agencies;
• All third parties, as noted in Annex A, with which we share this personal data are required to use your personal data in a manner that is consistent with this Privacy Policy.

However, these companies may only use such personal data for the purposes disclosed in this Privacy Policy and may not use it for any other purpose.

What is our Privacy Policy regarding children?

SBPL is very sensitive to privacy issues and it is especially careful in its communications with children. SBPL would never directly collect personal data from children without the parent’s consent.

Personal data pertaining to children and collected from their parents is used by SBPL or other entities that provide technical fulfillment or other services to SBPL (for example, services intended to improve our services/web sites, and fulfilling requests or administering promotions). These personal data are not sold.

Meanwhile, we urge parents to regularly monitor and supervise their children’s on-line activities.

How we protect your personal data?

We take reasonable steps to ensure that the personal data we collect, use or disclose are accurate, complete, and up-to-date. We strictly enforce this Privacy Policy within SBPL and we have implemented technological, organizational and physical security measures to protect your personal data from loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction. We put in effect safeguards such as the following:

• We keep and protect your personal data using a secured server behind a firewall, deploying encryption on computing devices and physical security controls.
• We restrict access to your personal data only to qualified and authorized personnel who hold your personal data with strict confidentiality.
• Any personal data that you provide on the sbpl.com.ph is initially processed and stored by SBPL or www.sbpl.com.ph, using a secured connection, only authorized SBPL personnel can then access and download your personal data from the system.

Where and how long do we keep your personal data?

All data are preserved in accordance with the following retention standards:

1. If the data subject has an existing contract and transaction with SBPL, the information will be retained all throughout the contract period and 10 years after its completion.
2. If the data subject has no existing contract but has existing transaction with SBPL, the information will be retained during the transaction and 5 years after its fulfillment.
3. If the data subject has no existing contract and transaction with SBPL, the information will be retained for a period of 2 years.

Personal data are stored in our facilities located in the Philippines and in our affiliate in Thailand are retained in accordance with the above parameters, industry standards, laws and regulations, unless you request that your personal data be deleted from our systems, databases and hardcopies immediately. Once deleted, your personal data will no longer be searchable or included in anonymous searches and will be completely removed from all the storage location.

The Data Privacy Officer may, however, choose not to grant access or correct information based on the request following laws and regulations. He/she will give the individual a written notice that sets out the reason for the refusal.

What if there are changes in our Privacy Policy?

SBPL may revise this Privacy Policy as the need arises or when dictated by issuances of the National Privacy Commission or any amendment to the Data Privacy Act. Any change to this Privacy Policy shall be duly posted in this website and will take effect immediately. Data subjects are encouraged to periodically check for such updates. Changes shall not be retroactively applied and will not alter how we handle personal data previously collected without obtaining your consent, unless required by law.

How you can access, correct and update the personal data we have about you?

To exercise your rights which include right to access, modify, erase and object to processing your personal data within a reasonable time after such request or should you have any inquiries, feedbacks on this Privacy Policy, and/or complaints to  www.sbpl.com.ph, you may reach us through our “Contact Us” menu in this website:  www.sbpl.com.ph, through a written letter or through an email to our Data Protection Officer (DPO).

Our contact details are as follows:

Address: 62 Horacio Dela Costa St., Bgy. Daungan, Mauban, Quezon

Email Address: SBPL_DPO@quezonservice.com

You may also lodge a complaint before the National Privacy Commission (NPC). For further details, please refer to NPC’s website: https://privacy.gov.ph/mechanics-for-complaints/.

Any action to a request for correction, erasure and/or objection to process your personal data as it appears in our records is subject to applicable laws and/or the DPA, its IRR and other issuances of NPC.

This Privacy Policy was last amended on May 9, 2019

Annex A: List of third-party/-ies to which we share your personal data