Privacy Notice

About this notice

• This notice is given under Section 16(a) of Republic Act No. 10173, the Data Privacy Act of 2012, which gives you the right to be informed about the collection and processing of your personal data.
• The company is the Personal Information Controller for the records described below. Its identity and address, and the contact details of its Data Protection Officer, appear at the end of this notice.
• We process your data according to the principles in Section 11 of the Act: transparency about what we do, a declared and legitimate purpose for doing it, and collection limited to what is proportionate to that purpose.

Personal information we collect

• Identity and contact details: your name, email address, contact number and permanent address.
• Employment records: employee number, position, detachment and post assignment, hire date, employment status and shift schedule.
• Emergency contact details for the person you nominate.
• Attendance records: for every clock-in and clock-out, a photograph taken at that moment, your GPS coordinates, the street address those coordinates resolve to, and the time.
• Time away during work: when you step away from your post or the office, the reason, your note, the times you left and came back, when you said you would be back and any time you added, and the GPS positions you share while away.
• Patrol rounds (roving guards): each checkpoint you scan, with the camera frame that read it, the time and your GPS position.
• Payroll records: pay rates, allowances, deductions, loan balances, reimbursements and generated payslips.
• System records: your sign-in activity and the changes you make to records in this system.

Sensitive personal information we collect

• Section 3(l) of the Act treats some categories as sensitive and prohibits processing them unless a specific exception in Section 13 applies. We hold two such categories.
• Government-issued identifiers: your SSS, PhilHealth, Pag-IBIG and TIN numbers.
• Health information: blood type, declared medical conditions, and the dates and results status of your pre-employment and periodic medical examinations, including those required of licensed security personnel.
• We do not collect information about your race, ethnic origin, marital status, age, colour, religious or philosophical affiliations, political affiliations, genetic data, sexual life, or any proceeding for an offence, except where a document you submit for your 201 file contains it and the law requires us to keep that document.

Our legal basis for processing it

• For personal information, we rely on Section 12(b) of the Act — processing necessary for and related to the fulfilment of your employment contract, which includes recording attendance, computing pay, and administering leave, overtime, complaints and claims.
• We also rely on Section 12(c) — compliance with a legal obligation — and on Section 12(f), our legitimate interest in verifying that the guard on record is the guard on post.
• For sensitive personal information, we rely on Section 13(b) — processing provided for by existing laws and regulations. Your SSS number is required under Republic Act No. 11199, your PhilHealth number under Republic Act No. 11223, your Pag-IBIG number under Republic Act No. 9679, and your TIN under the National Internal Revenue Code for withholding tax.
• Health information is likewise processed under Section 13(b): Republic Act No. 5487 and its implementing rules require medical and neuro-psychiatric clearance of licensed security personnel, Republic Act No. 9165 requires drug testing, and Republic Act No. 11058 with DOLE Department Order No. 198-18 requires occupational health surveillance and the keeping of medical records.
• Where a dispute arises, we may also rely on Section 13(f) — processing necessary for the establishment, exercise or defence of a legal claim.
• We do not rely on your consent for any of the above. Processing it is necessary for your employment and required by law, so acknowledging this notice records that you were informed. It is not permission, and withdrawing it is not something the company can offer for records it is legally obliged to keep.

The attendance photograph and location

• A GPS reading is captured only when you act: when you clock in or out (with a photograph), scan a patrol checkpoint, mark yourself away or back, or tap "Update my location" while away. While you are away the app reminds you to share your location, but it never reads it by itself. This system does not track you in the background or outside your duty.
• Your location while away is seen by those who supervise it: Operations for guards (a Satellite Operation for its own region only) and the Executive for office staff.
• They exist to confirm that the person clocking in is the guard assigned to that post at that time, which is the basis on which you are paid and on which the company reports to its clients and to the PNP Supervisory Office for Security and Investigation Agencies.
• To convert your coordinates into a readable street address, those coordinates are sent to an external mapping service. This is described in the next section.

Who we share it with

• You, for your own records, at any time through this system.
• HR staff: employee records, leave and overtime.
• Accounting staff: payroll figures, deductions and reimbursements.
• Supervisors and administrators: attendance for the personnel they supervise.
• Government agencies where reporting is required by law: the Social Security System, PhilHealth, the Pag-IBIG Fund, the Bureau of Internal Revenue, the Department of Labor and Employment, and the PNP Supervisory Office for Security and Investigation Agencies.
• Client establishments, limited to the fact of your assignment to their post and the times you were on duty there, where the service contract requires it.
• Transfer outside the Philippines: when you clock in or out, and when a supervisor views where you were while away, your GPS coordinates are sent to the Nominatim service operated by the OpenStreetMap Foundation, in order to resolve a street address. Your name, employee number and photograph are not sent to it — only the coordinates. Under Section 21 of the Act the company remains accountable for personal data transferred to a third party, including one located abroad.
• We do not sell your personal information, and we do not share it for marketing or profiling.

How long we keep it

• Employment and payroll records: at least three years, as required for employment records under the Omnibus Rules Implementing the Labor Code, and up to ten years for records forming part of the company books under Bureau of Internal Revenue Revenue Regulations No. 17-2013 as amended.
• Money claims under the Labor Code prescribe after three years, so records that may be needed to answer a claim are kept for at least that period after your employment ends.
• Records required of a licensed security agency are kept for the period prescribed by Republic Act No. 5487 and the rules of the PNP Supervisory Office for Security and Investigation Agencies.
• Medical and occupational health records are kept for the period required by Republic Act No. 11058 and DOLE Department Order No. 198-18.
• Attendance photographs and location records are kept for the period needed to support payroll disputes and regulatory inspection, and are then disposed of securely.
• Time away: the GPS positions are deleted automatically after 90 days. The summary (reason, note, times and approval) is kept with your attendance records, for the same period as employment records.
• Security event logs, including sign-in and account registration attempts, are kept for 90 days.

Your rights under the Data Privacy Act

• To be informed — this notice, and any later revision of it, which you will be shown before you continue using the system.
• To object to processing, including where it is based on our legitimate interests, subject to the processing we are legally required to carry out.
• To access — to be told what data we hold about you, where it came from, who it has been disclosed to, and how it is being processed.
• To correct — to have inaccurate or outdated information about you rectified, and to have the corrected version passed on to anyone it was already disclosed to.
• To erasure or blocking — to have your data removed from our systems where it is incomplete, outdated, false, unlawfully obtained, used for an undisclosed purpose, or no longer necessary.
• To damages — to be indemnified for any harm caused by inaccurate, incomplete, outdated, false or unlawfully obtained use of your personal data.
• To data portability under Section 18 — to obtain a copy of the data you provided in a commonly used, electronic format.
• To lodge a complaint with the National Privacy Commission, independently of anything the company decides.
• These rights are not absolute. Where the law requires us to keep or report a record, we will explain that rather than silently decline.

How we protect it

• Access is restricted by role, so staff can only reach the records their work requires.
• Changes to employee, leave, overtime and payroll records are written to an audit trail identifying who made the change and when.
• Attendance photographs are stored privately and cannot be reached by guessing a web address.
• Connections to this system are encrypted, and sessions sign out automatically after a period of inactivity.
• Passwords are stored hashed, sign-in attempts are rate limited, and staff can protect their accounts with two-factor authentication.
• Government ID numbers and medical information are encrypted in the database.

If something goes wrong

• If a personal data breach occurs that is likely to give rise to a real risk of serious harm, the company will notify the National Privacy Commission and the affected employees within 72 hours of becoming aware of it, as required by NPC Circular No. 16-03.
• The notification will describe the nature of the breach, the data involved, the measures taken, and how you can reduce the risk to yourself.
• If you believe your data has been mishandled, contact the Data Protection Officer first. You may go to the National Privacy Commission at any time, whether or not you have contacted us.

Who to contact

Personal Information Controller

OSSI

Registered office address

Data Protection Officer

Data Protection Officer

ossi.rnd@gmail.com

National Privacy Commission

You may complain to the Commission directly, whether or not you have contacted us first.

5th Floor, Delegation Building, PICC Complex, Vicente Sotto Ave., Pasay City 1307

complaints@privacy.gov.ph

https://www.privacy.gov.ph