PRIVACY POLICY


Verifacts Inc. a corporation duly organized and existing under the laws of the Philippines (“Company”), protects all data, including personal and sensitive personal information, that is entrusted to us.

At the Company, we respect and strive to ensure that your personal data is adequately protected. This Privacy Notice outlines how the Company collects, uses, maintains, transfers, shares, stores, and discloses your personal data in relation to the services the Company renders to you. We will only collect your personal information where it is necessary for us to do so in and for such relevant purposes in line with our transactions with you.

The Company maintains appropriate physical, technical, and organizational measures to ensure the security and confidentiality of your personal data. We only keep your information as long as it is relevant for the purposes of collection and only to the extent allowed by law.

The Company is committed to complying with Republic Act No. 10173 or the Data Privacy Act of 2012, and its implementing rules and regulations.

1. Collection of Personal Data

When you have a transaction with the Company, you may be asked to supply or provide information from time to time, including but not limited to, all information that you have provided to us, information to establish your identity (e.g., name, place of birth, birthdate), background, addresses, government-issued identification data and documents, photographs (either through camera access or by accessing your files), contact and mobile numbers, email addresses, IP addresses, operating systems, browser types, contact details, data concerning you that is available in the public domain, financial data, character references, employment records – current and past employers, your transcript of records, the details of your schools, universities, colleges, and past employers, Sensitive Personal Information as provided under the Data Privacy Act of the Philippines, the details provided in your identification cards that you have supplied to us, and telecommunications usage data and other information and data generated that you provide in relation to using, accessing, or availing of our products and/or services (“Personal Data”).

We may collect and obtain these Personal Data from yourself through manual or automated means or from a variety of sources, including but not limited to your submission of your Personal Data; from third parties and publicly available sources or registries; from the references that you have provided in your registration form/account registration form or any similar forms; from government authorities, regulatory authorities and/or law enforcement agencies; from third parties or other sources; and/or from any information that is supplied and/or collected when you visit our websites which include your mobile device or computer’s IP address or from any information that is collected via cookies on some of our websites.

2. Purpose of Collecting Personal Data

Your Personal Data shall be used for the following purposes:

1. To verify the information that you have provided to the Company on behalf of your potential employers and/or the Company’s clients and customers, for the purposes of your potential employment.
2. To ascertain your eligibility for employment for the Company’s clients and customers based on the information submitted to the Company.
3. To determine your suitability for matrimony, education, tenancy, award nomination, and other related and ancillary purposes.
4. To provide an accurate report to the Company’s customers and clients, according to their specified eligibility requirements or qualifications.

We shall occasionally request for additional Personal Data after the creation of your account and/or submission of the proper registration or application form. Your submission of any information to us, our authorized agents, or through our electronic systems expressly contains your warranty that such information is accurate.

3. Usage of Personal Data

During the course of your availment of our service, we may, through manual or automated means, use, process and/or disclose your Personal Data to the Company’s clients, customers, affiliates, subsidiaries and third-party partners for any of the following purposes (“Permitted Purposes”):-

• a. to authenticate your identity;
• b. to assess and process your applications for our services;
• c. to communicate with you, including but not limited to sending you updates and reminders, responding to your inquiries and/or complaints, and resolving disputes;
• d. to manage and maintain the data shared for the purpose of verification which is shared by client/candidate to conduct credit checks;
• e. to utilize the same for strategic alliances, cross-selling, marketing, and promotions with third-parties;
• f. to detect and investigate crime, fraud or illegal activities, and to utilize and disclose the same for investigation, prevention, prosecution and compliance with sanctions;
• g. to conduct a know-your-customer (KYC) in compliance with the policies of the company’s customers and/or clients, applicable laws, including but not limited to the Anti-Money Laundering and Terrorist Prevention Acts of the Republic of the Philippines;
• h. to respond to the requirements of a civil or criminal legal process and/or for regulatory compliance purpose and/or as required by law or regulation;
• i. to collect any amount owing and to us;
• j. to utilize and disclose the same for market research and statistical analysis and surveys with the aim of improving our products and services and product development;
• k. to verify the accuracy of records maintained by us and/or for us by third parties;
• l. to utilize the same for research, design and improvement of our products and services, operational and business processes;
• m. to support our business, financial and risk monitoring, planning and decision making;
• n. to handle complaints and queries;
• o. to utilize and disclose the same for audit, compliance and risk management;
• p. to transfer or assign our rights and duties under any governing terms and conditions between us and yourself;
• q. to utilize the same for our outsourcing of business and internal operations;
• r. to transfer your Personal Data to the Company’s clients and customers;
• s. to utilize your Personal Data to create reports and summaries to the Company’s clients and customers;
• t. to utilize and disclose the same for security reasons;
• u. to transfer your Personal Data to foreign jurisdictions for the purpose of processing and storage;
• v. to disburse and collect payments;
• w. to analyze voiceprint biometric data for the purpose of identity verification;
• x. to conduct data analytics and data profiling; and/or
• y. for any other purposes that is required or permitted by any law, regulation, order and/or guidelines.

We also use cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our website.

Privacy laws in the European Economic Area (EEA), including the General Data Protection Regulation, or GDPR, the Data Privacy Act of the Republic of the Philippines, require websites to obtain consent using or storing some cookies (or similar technologies) on your computers or mobile devices. By indicating your consent to the use of cookies, you agree that we can place cookies and other similar technology on your device, including a mobile device. This cookie policy provides you with clear and comprehensive information about the cookies we use and the purposes for using those cookies.

4. Disclosure of Personal Data

Your Personal Data held by us shall be kept confidential at all times. Nonetheless, you explicitly consent to us providing, transferring, storing, disclosing, or otherwise processing your Personal Data, in connection with our services, to the following parties, in and/or outside the Philippines:

• a. the Company’s clients and customers;
• b. the Company agents, parent companies, holding companies, subsidiaries, affiliates and associates;
• c. third-party professional advisers, contractors, and other agents with whom we have contractual agreements for some of our functions and services;
• d. any actual or potential participants or assignee or transferee of our rights and/or obligations under any transaction between us and you;
• e. any authorities or regulators, including foreign regulators for the performance of their functions, or any party as required by any law or any government, quasi-government, administrative, court or tribunal;
• f. strategic/business partners with whom we have a relationship with;
• g. any person connected to the enforcement or preservation of any of our rights under your agreements with us; and/or
• h. any party authorized and/or consented by you.

In addition, we share your Personal Data with our affiliates, who process and store your data in accordance with the applicable Data Privacy laws in their jurisdiction and in compliance with the Data Privacy Act, including the following:

CIBI

Fran Parentela: fparentela@cibi.com.ph

Corpnet Global

Abad Paguia: abad.paguia@corpnetglobal.com

Our sharing with the above-mentioned entities are for the following purposes:

1. Further processing/fulfillment of the subject’s background screening
2. Adjudication on the subject’s background screening result

5. Changes to Personal Data

You must keep the Personal Data provided to the Company up-to-date, and inform us of changes thereto. You can review your Personal Data that we have collected and request for collection and you have the right to update your Personal Data.

If you have any changes regarding your Personal Data or should you believe that the data we have collected about you is inaccurate or incomplete, you can send an email to our Data Protection Officer (“DPO”) dpo-manila@verifacts.ph via email with your request, supporting documents, a valid Identification Card and your full name. Provided Further that our DPO can make further requests for documents to verify the accuracy or completeness of your request.

The Company shall endeavor to correct and update your information as soon as possible.

6. Withdrawal of Consent

You may communicate your objection to our continued use, collection, and/or other acts of processing of your Personal Data for any valid purpose by sending an email to our DPO with your request and, full name, and other supporting documents that may be appropriate. Your objection or withdrawal of your consent for the processing of your Personal Data may affect the timeliness of our fulfillment of our obligations to you and our clients. For this purpose, you agree that such a request will release the Company for any damages or legal actions or claims that may arise by reason of such withdrawal. Our legal rights and remedies are expressly reserved in such events.

7. Removal of Personal Data

We shall retain your Personal Data, registration, and transaction records on-site, with our affiliates or sister and parent companies, or with a third-party data storage provider for a period of 7 years for our legitimate business purposes, the purposes stated in the Privacy Notice, the establishment, exercise, or defense of legal claims; or for legitimate business purposes, which must be consistent with standards followed by the applicable industry; or in cases that involve the application of the regulations of the Bangko Sentral ng Pilipinas (BSP) and other laws and regulations, for a maximum period of ten (10) years.

We will dispose of your Personal Data in irretrievable and unusable form in adherence with our physical and/or technical information security measures when retention is no longer allowed or required.

We reserve the right to take necessary actions, including preservation of your data, if we consider that such removal or cessation would hamper our fulfillment of our obligations under applicable laws, orders of the court, or any other instruction of administrative agencies.

We shall suspend, withdraw, or order the blocking, removal or destruction of your Personal Data from our system if we become aware or reasonably suspect that the Personal Data is incomplete, outdated, false, unlawfully obtained; used for unauthorized purposes, no longer necessary for the purposes for which they were collected; or you withdraw consent or object to the processing, and there is no other legal ground or overriding legitimate interest for the processing.

8. Security and Potential Risks

We will make reasonable efforts to protect personal data in our possession or our control by making reasonable physical, technical, and organizational security arrangements to ensure the security and confidentiality of your personal data.

Risk refers to the potential of an incident to result in harm or danger to a data subject or organization. Risks may lead to the unauthorized collection, use, disclosure, or access to personal data. It includes risks involving the confidentiality, integrity, and availability of personal data or the risk that processing will violate the general data privacy principles and the rights of data subjects.

The Company ensures that adequate physical, technical, and organizational security measures are in place to protect personal information’s confidentiality, integrity, and availability.

However, this does not guarantee absolute protection against certain risks involving the processing of personal data, such as when systems are exposed to targeted cyberattacks, malware, ransomware, and computer viruses or when manual records are accessed without authority. However, adequate policies are in place to ensure appropriate security incident management in line with existing policies, circulars, and other issuances of the appropriate authority.

9. Portability

You have the right to receive your Personal Data, which you have provided to us in a structured, commonly used, and machine-readable format, and you have a right to request that we transfer such Personal Data to another party. We have the right to refuse such transfer for any legal ground.

10. Profiling

“Profiling” refers to any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.

• • You are hereby informed and explicitly give consent to us to access and process your Personal Data by manual or automated processing and decision making.

Our profiling process involves the processing of the following data:

1. Identity the specific criteria relevant to the background check. This could include criminal history, employment verification, education verification, credit history, driving records, and other relevant factors based on the purpose of the screening.
2. Data collection where the screening company gathers relevant information from various sources. This may involve accessing public records, databases, contacting previous employers and educational institutions.

The purpose of this profiling and decision making is for the following:

1. Help organizations or individuals make informed choices that minimize risk and ensure safety, security, and integrity of their operations.
2. To combat money laundering, terrorism financing, to combat and detect fraud, assessment of risk and other offenses, or as required by or for the purpose of any court, legal process, examination, inquiry, audit, or investigation of any Authority.

You have the right to appeal to the Company the decisions made by our automated profiling system.

11. Your Rights under the Data Privacy Act

The Data Privacy Act (DPA) establishes that you have the following rights as a data subject:

• a. You have the right to indicate your refusal or withdrawal of consent to the collection and processing of your personal data. You also have the right to be informed and to withhold your consent to further processing in case there are any changes or amendments to information given to you. Once you have notified us of the withholding of your consent, further processing of your personal data will no longer be done, unless the processing is required pursuant to a subpoena, lawful order, or as required by law.
• b. You have the right to reasonable access to your personal data. Furthermore, you have the right to limit and prevent disclosure of your personal data and to receive notification of any possible breaches of your personal data.
• c. You may also correct or remove any information that you think is inaccurate. You have the right to dispute any inaccuracy or error in your personal data. You may request for the correction or removal of any inaccuracy or error in your personal data by logging into your account or making a formal request with our Data Privacy Officer.
• d. You have the right to the destruction of your personal data;
• e. You have the right to damages; and
• f. You have the right to lodge a complaint with the National Privacy Commission (NPC).

Please check Chapter IV, Section 16 of the DPA for the exact list and rights you may have as a data subject.

Throughout the processing of your Personal Data, your rights under the DPA, such as the (1) right to be informed, (2) right to object, (3) right to access, (4) right to rectification, (5) right to erasure or blocking, and (6) right to damages, shall be upheld. Entities to whom we share your data will also respect the same rights.

If you would like to make any request in relation to your rights, please contact our DPO.

12. Inquiries and Complaints

You have the right to object at any time to the processing of your Personal Data to the extent permitted under the Philippine law, and to the processing of your personal data for the Permitted Purpose. Any queries, requests, concerns, complaints, or exercise of your rights regarding the use of your Personal Data may be raised to the respective DPO below:

Email: dpo-manila@verifacts.ph

Mailing Address: 9th Floor, Filinvest One Building, Northgate Cyberzone, Alabang Zapote Road corner Northgate Avenue, Filinvest, Alabang, Muntinlupa City, 1781

13. Changes to the Privacy Notice

We may update this Privacy Notice by posting an updated version on our website or any other appropriate channel. We advise you to periodically review such channels for any updates concerning our privacy policy. The updated version of the Privacy Policy shall apply to all of your information held and processed by the Company. You may reject the application of the updated policy by contacting our DPO.

14. Consent and Acknowledgement

By providing us with your Personal Data, you hereby consent to the usage, processing, and/or disclosure of your Personal Data in accordance with this Privacy Notice to the Company, its parent companies, affiliates, subsidiaries, and partner institutions, clients, and the Company’s customers.

If you have provided/disclosed Personal Data of individual third-parties including but not limited to your references, past employers, schools, universities, past workplaces, character references, company directors, individual shareholders, employees, authorized signatories, agents, representative or otherwise, you hereby represent and warrant to us that you have the consent of such third parties and are entitled to provide their Personal Data to us to be used, processed, and/or disclosed in accordance with this Privacy Notice.

15. Action against misuse or breach of policy

Under the Data Privacy Act of 2012 (Republic Act No. 10173), the following penalties apply:

• 15.1 Unauthorized Processing of Personal Information and Sensitive Personal Information: Imprisonment ranging from three (3) to six (6) years and a fine of not less than PHP 1,000,000 but not more than PHP 5,000,000.
• 15.2 Accessing Personal Information and Sensitive Personal Information Due to Negligence: Penalties for this offense apply due to negligence.
• 15.3 Improper Disposal of Personal Information and Sensitive Personal Information: Penalties for improper disposal.
• 15.4 Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes: Penalties for unauthorized processing.
• 15.5 Unauthorized Access or Intentional Breach: Penalties for unauthorized access or intentional breach.
• 15.6 Concealment of Security Breaches Involving Sensitive Personal Information: Penalties for concealing security breaches.
• 15.7 Malicious Disclosure and Unauthorized Disclosure: Penalties for disclosure offenses.
• 15.8 Combination or Series of Acts: A combination of offenses can lead to imprisonment and fines.