Data Privacy Statement & Policy
ARIVA Academy Philippines, Inc. is committed to protecting the privacy and security of your Personal Data in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and related issuances of the National Privacy Commission.
Our Commitment
ARIVA ACADEMY PHILIPPINES, INC. (ARIVA), the ARIVA app and its websites, including ariva.com.ph / arivatalks.com / hrdacademy.ph / arivaacademy.asia, are committed to protecting your privacy. You can visit most pages on our websites without giving us any information about yourself, except your IP address that may be collected through the use of cookies. Note further that you will need to register if you want to participate in any of our Hybrid and Webinar learning events conducted or administered through applicable ARIVA platforms and websites, including ariva.com.ph / arivatalks.com / hrdacademy.ph / arivaacademy.asia. The personal information requested is necessary to process your registration and attendance to applicable ARIVA Hybrid and Webinar learning events.
We need specific personal information to provide you with best user and client services. This Privacy Statement explains data collection, retention, and use in strict compliance with the Data Privacy Act of 2012, its Implementing Rules and Regulations and related issuances from the National Privacy Commission.
ARIVA ACADEMY PHILIPPINES, INC. (ARIVA), the ARIVA app and its websites are not responsible for the content and/or privacy policies of third-party websites to which our websites may link. This Privacy Policy applies to the processing of personal information by ARIVA through its websites and services, including ariva.com.ph / arivatalks.com / hrdacademy.ph / arivaacademy.asia, where applicable.
Collection of your Personal Information
We will ask you when we need information that personally identifies you. Personal information collected by ARIVA is necessary to (1) establish your identity as a participant or as representative of the participant or as a point person of the company/employer of the participant, (2) to process your registration, and (3) to personalize the services provided to you. ARIVA collects Personal Data for specific and legitimate purposes, including establishing participant identity, processing registrations, verifying attendance, administering learning events, managing ARIVA Academy App accounts and related services, communicating with participants, and preparing statistical and operational reports. Where appropriate, statistical reports shall be presented in aggregated or anonymized form. Personal Data may also be used for marketing and promotional activities only where permitted by applicable law and supported by an appropriate lawful basis. ARIVA shall not sell Personal Data to third parties.
ARIVA collects personal information for specified purposes, including establishing participant identity, processing registration, verifying attendance, administering learning events, managing ARIVA Academy App accounts and related services, communicating with participants, and preparing statistical and operational reports. Personal information may also be processed for marketing or promotional activities where permitted by applicable law and supported by an appropriate lawful basis.
Statistical reports shall be presented in aggregated or anonymized form where appropriate. ARIVA shall not sell personal information to third parties.
To register and participate in our Hybrid and Webinar learning events, you will need to provide the following:
- Full Name
- Date of Birth
- Contact Numbers
- Organization or Company Information
- Other information voluntarily provided through the registration process
ARIVA collects participants' dates of birth for two purposes: (1) to facilitate registration for and use of the ARIVA Academy App, where date of birth is a required registration field; and (2) to identify participants whose birthdays fall on scheduled ARIVA event dates so the Company may provide birthday greetings and, where applicable, birthday cakes. Providing the year of birth is not required. Date of birth shall be processed only for these stated purposes and other compatible purposes supported by an applicable lawful basis under the Data Privacy Act of 2012.
When you register through online platform, the information enumerated above shall be required of you to process your registration. ariva.com.ph / arivatalks.com / hrdacademy.ph / arivaacademy.asia may use cookies and collect information during the online registration process. A cookie is a small amount of data that is sent to your browser from a webserver and stored on your gadget's (computer or mobile) hard drive. ariva.com.ph / arivatalks.com / hrdacademy.ph / arivaacademy.asia uses identifying cookies to provide easier site navigation and a personalized experience. The cookie placed on your computer is required; however, it only contains an encrypted "session id" to help us identify you when you return to ariva.com.ph / arivatalks.com / hrdacademy.ph / arivaacademy.asia.
When you contact ARIVA by email, we will use your email address to respond to your inquiry and provide information related to your request. Marketing materials and promotional communications will be sent only where permitted by applicable law and where an appropriate lawful basis exists. Where consent is relied upon, marketing consent shall be optional and separate from the processing necessary to respond to your inquiry. Refusing marketing communications shall not affect our response to your inquiry. Your email address shall not be disclosed to unauthorized third parties.
When you register through mobile phones, we may collect the full names, e-mail addresses, contact numbers, organization or company information, and other information necessary for registration and event administration. Additional information, such as an address, may be requested only when necessary for a specific and stated purpose.
ARIVA may use QR codes during registration, event entry, attendance verification, and other event-related activities. When a participant scans an ARIVA QR code, the information submitted or collected through the platform or form accessed by the QR code may be processed for registration, identity and attendance verification, event administration, communication, and other stated purposes.
The Personal Data collected through QR code-enabled registration or attendance processes shall be processed in accordance with this Data Privacy Statement, applicable privacy notices, and Republic Act No. 10173 - Data Privacy Act of 2012, its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission.
Use of your Personal Information
ARIVA may collect contact and address information when necessary for a stated purpose, such as responding to inquiries, administering event participation, processing transactions, or arranging the delivery of ARIVA Store merchandise. Address information shall not be required where it is unnecessary for the service requested.
Where a website or online platform displays participant names, usernames, or other profile information to other users, ARIVA shall explain what information may be displayed, who may view it, and how individuals can manage the applicable settings, where such controls are available. Personal information shall not be made publicly accessible unless the disclosure is supported by an applicable lawful basis and the individual has been appropriately informed.
ARIVA Academy Philippines, Inc. may disclose personal information when required or permitted by applicable law, including when necessary to comply with a lawful order or legal process, protect and defend its rights or property, or address an urgent situation involving the safety of individuals or the public. ARIVA may also share personal information with authorized service providers and other recipients where necessary for a stated purpose, supported by an applicable lawful basis, and subject to appropriate safeguards and confidentiality obligations.
Submission of a registration or feedback form does not, by itself, authorize ARIVA to publish a participant's name, photograph, employer, job title, statement, interview, or testimonial for promotional purposes. Where ARIVA relies on consent for such use, it shall obtain separate, specific, informed, and recorded authorization that identifies the intended promotional use and applicable publication channels. Refusal to provide optional promotional consent shall not affect access to the event or its standard benefits. Any withdrawal of consent shall be handled in accordance with applicable law, including any applicable limitations on the removal of materials already published.
Data Retention
ARIVA retains personal information only for as long as necessary for the purpose for which it was collected, or for the period required by applicable law or justified by a legitimate business need. Depending on the type of record, this may include registration and attendance records, certificate records, accounting documents, event photographs and recordings, consent records, and incident reports. ARIVA applies specific retention periods or criteria to these records and securely disposes of them when they are no longer required. Certain records may be retained longer where required by law or where necessary for an audit, investigation, or the establishment, exercise, or defense of legal claims. Routine backups are retained according to a separate backup schedule.
Control of your Personal Information
ARIVA limits the disclosure of personal information to authorized recipients and circumstances supported by an applicable lawful basis. Personal information may be processed by authorized service providers acting on behalf of ARIVA where necessary to deliver services, administer events, operate online platforms, process transactions, or support other stated purposes, subject to appropriate contractual and security safeguards.
ARIVA may also disclose personal information where required or authorized by applicable law. The relevant privacy notice shall explain the applicable categories of recipients and purposes of disclosure. ARIVA shall not sell personal information to third parties.
Access to Your Personal Information
Individuals may contact ARIVA's Data Protection Officer to request access to, correction of, or other appropriate action concerning their personal information, subject to the Data Privacy Act of 2012 and other applicable laws. Requests may be submitted through the contact details provided in this Privacy Statement.
ARIVA may take reasonable steps to verify the identity and authority of the person making a request before processing it. Requests shall be assessed and handled in accordance with applicable legal requirements. Where a request cannot be fully granted, ARIVA shall provide an appropriate explanation, subject to applicable law.
Individuals may also raise privacy concerns or complaints with ARIVA's Data Protection Officer and may lodge a complaint with the National Privacy Commission where appropriate.
Security of Your Personal Information
ARIVA implements reasonable and appropriate organizational, physical, and technical security measures to protect personal information against unauthorized access, use, alteration, disclosure, loss, or destruction. These measures are proportionate to the nature of the information processed and the risks involved.
Where personal information is transmitted or stored through ARIVA's systems or authorized service providers, appropriate safeguards shall be applied in accordance with the relevant system configuration, applicable security requirements, and ARIVA's internal security procedures. Access to personal information shall be limited to authorized individuals who require it for their assigned responsibilities.
Use of Cookies
ARIVA may use cookies and similar technologies to support website functionality, maintain user sessions, improve navigation, and understand website usage, where applicable. The types of cookies and information collected depend on the website's actual configuration.
Where third-party cookies or similar technologies are implemented, ARIVA shall provide appropriate information about their purposes and relevant third-party processing. Users may manage cookies through available website controls or browser settings, subject to essential website functionality and applicable requirements.
Third-Party Cookies
Third-party cookies or similar technologies shall be described in the applicable privacy or cookie notice where they are actually implemented. ARIVA shall verify the use of these technologies and avoid statements about advertisers or tracking tools that do not reflect its actual website configuration.
Enforcement of & Changes to this Privacy Policy
If you have questions regarding this policy, you may contact ARIVA through our Data Protection Officer, Mr. Earl C. Flores, at dpo@ariva.com.ph or by phone at (632) 8832-9901 / (632) 8835-9354.
ARIVA may update this privacy policy. When we do, we will also revise the "last updated" date of the Privacy Statement. For material changes to this statement, ARIVA will notify you by placing a prominent notice on the main page of ariva.com.ph / arivatalks.com / hrdacademy.ph / arivaacademy.asia. ARIVA shall adhere to applicable data privacy requirements and continuously improve this policy and related privacy practices.
Table of Contents
- 01Introduction
- 02Scope and Limitation
- 03Data Protection Officer
- 04Data Privacy Principle
- 05Data Processing Records
- 06Management of Human Resource
- 07Employment Agreement
- 08Data Collection Procedure
- 09Data Retention Schedule
- 10Physical Security Measures
- 11Technical Security Measures
- 12Rights of the Data Subject
- 13Right to be Informed
- 14Right to Object
- 15Right to Access
- 16Right to Rectification
- 17Right to Erasure or Blocking
- 18Transmissibility of Rights of Data Subjects
- 19Data Portability
- 20Data Breaches and Security Incidents
- 21Data Breach Notification
- 22Breach Reports
- 23Outsourcing and Subcontracting Agreements
- 24Data Privacy
Definition
- ARIVA
- Refers to ARIVA ACADEMY PHILIPPINES INC., a corporation duly organized and existing under the laws of the Republic of the Philippines and primarily provides learning events including Public Seminars, Learning Sessions, Customized In-house Trainings, Congress and Conferences.
- Data Breach Response Team or BRT
- Refers to the ARIVA team mandated to assess and evaluate Security Incidents such as personal data breaches, restore integrity to the information and communication systems, mitigate and remedy resulting damages, and comply with reportorial requirements.
- Data Privacy Act or DPA
- Refers to Republic Act No. 10173 or the Data Privacy Act of 2012 and its Implementing Rules and Regulations.
- Data Subject
- Refers to an individual whose Personal Information, Sensitive Personal Information, or Privileged Information is processed.
- Personal Data
- Refers to the collection of Personal Information, Sensitive Personal Information, and Privileged Information.
- Personal Data Breach
- Refers to a breach of security leading to the accidental or unlawful destruction, loss (Availability Breach), alteration (Integrity Breach), unauthorized disclosure of, or access to (Confidentiality Breach), personal data transmitted, stored, or otherwise processed by ARIVA.
- Personal Information
- Any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
- Processing
- Any operation or set of operations performed upon Personal Data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. Processing may be performed through automated means, or manual processing, if the Personal Data are contained or are intended to be contained in a filing system.
- Privileged Information
- All forms of Personal Data which, under the Rules of Court and other pertinent laws, constitute privileged communication.
- Risk
- Refers to the potential of an incident to result in harm or danger to a Data Subject or organization.
- Security Incident
- An event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity and confidentiality of Personal Data. It includes incidents that would result in a personal data breach, if not for safeguards that have been put in place.
- Threat
- Refers to a potential cause of an unwanted incident, which may result in harm or danger to a Data Subject, system, or organization.
- Vulnerability
- Refers to a weakness of a data processing system that makes it susceptible to privacy threats and other attacks.
Sensitive Personal Information
Personal Data that may cover the following information:
- 1.An individual's race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations.
- 2.An individual's health, education, genetic or sexual life, or to any proceeding for any offense committed or alleged to have been committed by such individual, the disposal of such proceedings, or the sentence of any court in such proceedings.
- 3.Details issued by government agencies peculiar to an individual which includes, but is not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns.
- 4.Details specifically established by an executive order or an act of Congress to be kept classified.
Introduction
In accordance to Philippine's Data Privacy Act, ARIVA will monitor the compliance of this document which contains information from Republic Act 10173 - Data Privacy Act of 2012. This policy intends to implement the privacy of data that ARIVA possess in compliance to the Philippine government's ruling.
Scope and Limitations
All personnel of ARIVA, regardless of the type of employment or contractual arrangement, must comply with the terms of this Privacy Manual.
Third party suppliers, vendors, partners, and sponsors are equally mandated to strictly comply with this Privacy Manual. Compliance by third parties, with the provisions of this Privacy Manual, shall be the responsibility of the section or department that engaged such third party.
Data Protection Officer
A Data Protection Officer ("DPO") shall be appointed by ARIVA. The DPO appointment shall be registered with the National Privacy Commission (NPC) together with the required reportorial and documentary requirements for the proper registration of the appointment of the DPO.
The DPO is responsible for ensuring the Company's compliance with applicable laws and regulations for the protection of data privacy and security. The DPO's functions and responsibilities shall particularly include, among others:
- 1.Monitoring ARIVA's Personal Data Processing activities in order to ensure compliance with applicable Personal Data privacy laws and regulations, including the conduct of periodic internal audits and review to ensure that all data privacy policies are adequately implemented and observed by its employees and authorized agents.
- 2.Acting as a liaison between ARIVA and the regulatory and accrediting bodies, and is in charge of the applicable registration, notification, and reportorial requirements mandated by the Data Privacy Act, as well any other applicable data privacy laws and regulations.
- 3.Developing, establishing, and reviewing policies and procedures for the exercise by Data Subjects of their rights under the Data Privacy Act and other applicable laws and regulations on Personal Data privacy.
- 4.Acting as the primary point of contact whom Data Subject may coordinate and consult with for all concerns relating to their Personal Data.
- 5.Formulating capacity building, orientation, and training programs for employees, agents or representatives of ARIVA regarding Personal Data privacy and security policies.
- 6.Preparing and submitting the Annual Security Incident Report (ASIR) containing the summary of documented Security Incidents and Personal Data Breaches, as required by the Data Privacy Act, its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission.
Data Privacy Principle
- 1.Transparency. The Data Subject must be aware of the nature, purpose, and extent of the Processing of his or her Personal Data by ARIVA, including the risks and safeguards involved, the identity of persons and entities involved in processing his or her Personal Data, his or her rights as a Data Subject, and how these can be exercised. Any information and communication relating to the Processing of Personal Data should be easy to access and understand, using clear and plain language.
- 2.Legitimate purpose. The Processing of Personal Data by ARIVA shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.
- 3.Proportionality. The Processing of Personal Data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal Data shall be processed by the Company only if the purpose of the Processing could not reasonably be fulfilled by other means.
Data Processing Records
Adequate records of the ARIVA's Personal Data Processing activities shall be maintained at all times. The DPO, in cooperation and assistance of all the concerned business and service units involved in the Processing of Personal Data, shall be responsible for ensuring that these records are kept up-to-date.
These records shall include, at the minimum:
- 1.Information about the purpose of the Processing of Personal Data, including any intended future Processing or data sharing.
- 2.A description of all categories of Data Subjects, Personal Data, and recipients of such Personal Data that will be involved in the Processing.
- 3.General information about the data flow within the Company, from the time of collection and retention, including the time limits for disposal or erasure of Personal Data.
- 4.A general description of the organizational, physical, and technical security measures in place within the Company.
- 5.The name and contact details of the DPO, Personal Data processors, as well as any other staff members accountable for ensuring compliance with the applicable laws and regulations for the protection of data privacy and security.
Management of Human Resource & Employment Agreement
The DPO, with the cooperation of ARIVA's corporate Human Resources Department (HRD), shall develop and implement measures to ensure that all the Company's staff who have access to Personal Data will strictly process such data in compliance with the requirements of the Data Privacy Act and other applicable laws and regulations. These measures may include drafting new or updated relevant policies of ARIVA and conducting training programs to educate employees and agents on data privacy related concerns.
The DPO, with the assistance of HRD, shall ensure that ARIVA shall obtain the employee's informed consent, evidenced by written, electronic or recorded means, to:
- 1.The Processing of his or her Personal Data, for purposes of maintaining ARIVA's records; and
- 2.A continuing obligation of confidentiality on the employee's part in connection with the Personal Data that he or she may encounter during the period of employment with ARIVA. This obligation shall apply even after the employee has left the Company for whatever reasons.
Data Collection Procedure
The DPO, with the assistance of HRD and any other departments of the Company responsible for the processing of Personal Data, shall document the Company's Personal Data Processing procedures. The DPO shall ensure that such procedures are updated and that the consent of the Data Subjects (when required by the DPA or other applicable laws or regulations) is properly obtained and evidenced by written, electronic or recorded means. Such procedures shall also be regularly monitored, modified, and updated to ensure that the rights of the Data Subjects are respected, and that Processing thereof is done fully in accordance with the DPA and other applicable laws and regulations.
Personal information collected by the Company and its website is necessary to (1) establish the identity of a participant or as representative of the participant or as a point person of the company/employer of the participant, (2) to process registration, and (3) to personalize the services provided. Personal information may be used for statistical and reporting purposes, provided that reports are presented in an aggregated or anonymized form where appropriate. Personal information may also be used for promotional, marketing, or future communications only where permitted by applicable law and where an appropriate lawful basis exists. ARIVA shall not sell personal information to third parties.
To register and participate in ARIVA Hybrid and Webinar learning events, a participant will need to provide the following:
- Full Name
- Date of Birth
- Email Address
- Contact Number(s)
- Organization or Company Information
- Other information voluntarily provided
Date of birth is collected as a required field for registration for the ARIVA Academy App. It is also required for event registration to identify participants whose birthdays coincide with scheduled ARIVA event dates, allowing ARIVA to provide birthday greetings and, where applicable, birthday cakes. Participants are not required to provide their birth year. Access to this information shall be limited to authorized personnel who need it to carry out these specific purposes. ARIVA shall retain the information only for as long as necessary to fulfill the stated purposes or as otherwise required or justified under applicable law.
Registration via Online Platform
The information enumerated above shall be required of to process registration. The Company's website may use cookies and collect information during the online registration process. A cookie is a small amount of data that is sent to a user's browser from a webserver and stored on the user's gadget (computer or mobile) hard drive. The Company website uses identifying cookies to provide easier site navigation and a personalized experience. The cookie placed on the user's computer is required; however, it only contains an encrypted "session id" to help the Company identify a user upon return to the website.
Registration via QR Code
ARIVA may use QR codes to provide access to registration forms, attendance forms, event information, or other ARIVA services. Information submitted or collected through the destination platform accessed by the QR code may be processed for registration, identity and attendance verification, event administration, and other stated purposes. Such Personal Data shall be processed in accordance with this Data Privacy Policy, applicable privacy notices, and the Data Privacy Act of 2012 and its implementing rules and regulations.
Registration via Email
The Company will use sender or registrant's e-mail address for the purpose of sending its response and other marketing materials. Such address shall not be shared with outside parties.
Registration via Phone
The Company will require the consent of registrant to provide the participants' full names, e-mail addresses, contact numbers, home or office addresses, employer and job titles of the attendees.
Republic Act No. 10173 - Data Privacy Act of 2012 (DPA): Personal information includes information from which an individual can be identified. Identifiable images captured in photographs and videos may constitute personal information subject to the DPA.
Hard Copy and Physical Registration Forms
ARIVA may collect and process Personal Data through physical or hard-copy forms used for registration and event-related activities. These may include Registration Forms, Walk-In Registration Forms, Raffle Forms, Seminar Reservation Forms, and other similar forms used in connection with ARIVA programs, seminars, events, and activities.
The information collected through these forms shall be processed for registration, identity and attendance verification, event administration, communication, and other legitimate and stated purposes, in accordance with Republic Act No. 10173 - Data Privacy Act of 2012, its Implementing Rules and Regulations, and applicable policies and issuances of the National Privacy Commission.
ARIVA Academy App and Online Platform
The ARIVA Academy App and related online platform, accessible through arivaacademy.asia, may collect and process Personal Data necessary for account registration, authentication, participation in ARIVA learning events and activities, loyalty programs, transactions, and other services provided through the platform. Personal Data collected through the ARIVA Academy App shall be processed in accordance with this Data Privacy Policy, applicable privacy notices, and the Data Privacy Act of 2012 and its implementing rules and regulations.
All documents that contain personal information shall have the appropriate Data Privacy Notice.
Photography, Recordings, and Livestreaming
ARIVA may conduct photography, audio recording, video recording, and livestreaming during events for the following purposes, subject to the applicable notice:
- 1.Event documentation and organizational records. ARIVA may document event activities for attendance records, reporting, internal reference, and other stated administrative purposes, where necessary and permitted by applicable law.
- 2.Educational and training purposes. Recordings may be used to document or deliver training sessions and related educational materials. Access shall be limited to authorized persons or intended recipients, as applicable to the event and its stated purpose.
- 3.Livestreaming and event access. Where an event is livestreamed or recorded for remote access, participants shall be informed before and during registration and through notices displayed at the venue. The notice shall identify the event or session being recorded or livestreamed, the intended audience, where recordings may be accessed or published, the relevant recipients, and the applicable retention period or retention criteria.
- 4.Marketing and promotional activities. The use of a participant's identifiable image, voice, name, interview, statement, or testimonial in advertising or promotional materials shall be treated separately from routine event documentation. Where consent is the lawful basis, ARIVA shall obtain specific, informed, and recorded authorization before such promotional use. Providing feedback, attending an event, or appearing in a general event recording shall not, by itself, constitute consent to use a participant's image or statements in advertising.
ARIVA shall provide appropriate privacy notices during registration and at the event venue, informing participants that photography, audio recording, video recording, and livestreaming may take place during events. The notice seen at the venue should explain the purpose of the recording and direct participants to event staff should they have any concerns or questions regarding the recording.
Where practicable, ARIVA shall provide reasonable arrangements for participants who object to being included in recordings, such as designated seating or areas outside the main camera view, and instructions to event photographers and recording teams to avoid capturing those participants where feasible. Participants may raise concerns with the designated event staff or Data Protection Officer. Any objection shall be assessed in light of the purpose and applicable lawful basis for the processing.
Recordings shall be accessed, shared, published, retained, and disposed of only in accordance with the stated purpose, applicable privacy notices, approved retention arrangements, and applicable data privacy requirements.
Data Retention Schedule
Subject to applicable requirements of the DPA and other relevant laws and regulations, Personal Data shall not be retained by the Company for a period longer than necessary and/or proportionate to the purposes for which such data was collected. The DPO, with the assistance of the Company's HRD and any other departments of the Company responsible for the Processing of Personal Data, shall be responsible for developing measures to determine the applicable data retention schedules, and procedures to allow for the withdrawal of previously given consent of the Data Subject, as well as to safeguard the destruction and disposal of such Personal Data in accordance with the DPA and other applicable laws and regulations.
The retention periods in this schedule are subject to applicable legal, regulatory, tax, employment, contractual, and other recordkeeping requirements. Records shall not be destroyed while they are subject to a legal hold, pending or reasonably anticipated litigation, investigation, audit, regulatory request, or other documented preservation requirement.
Where an exception applies, the responsible department shall document the reason for continued retention, restrict access to the records, and review the need for continued retention periodically. Once the legal obligation or hold has ended, the records shall be securely disposed of in accordance with the applicable retention schedule.
Personal data shall be disposed of securely to prevent unauthorized access, recovery, disclosure, or further processing. The responsible department shall document disposal where appropriate. The DPO shall oversee compliance with this schedule and coordinate periodic reviews with the departments responsible for the records.
Physical Security Measures
The DPO, with the assistance of HRD, shall develop and implement policies and procedures for the Company to monitor and limit access to, and activities in all the offices and Hybrid and Webinar learning events venues of ARIVA, as well as any other locations and/or workstations in the Company where Personal Data is processed, including guidelines that specify the proper use of, and access to, electronic media.
The design and layout of the office spaces and work stations of the abovementioned departments, including the physical arrangement of furniture and equipment, shall be periodically evaluated and readjusted in order to provide privacy to anyone Processing Personal Data, taking into consideration the environment and accessibility to unauthorized persons.
The duties, responsibilities, and schedules of individuals involved in the Processing of Personal Data shall be clearly defined to ensure that only the individuals actually performing official duties shall be in the room or work station, at any given time. Further, the rooms and workstations used in the Processing of Personal Data shall, as far as practicable, be secured against natural disasters, power disturbances, external access, and other similar threats.
Technical Security Measures
The DPO, with the cooperation and assistance of HRD, shall continuously develop and evaluate the Company's security policy with respect to the Processing of Personal Data. The security policy should include the following minimum requirements:
- a.Safeguards to protect the Company's computer network and systems against accidental, unlawful, or unauthorized usage, any interference which will affect data integrity or hinder the functioning or availability of the system, and unauthorized access.
- b.The ability to ensure and maintain the confidentiality, integrity, availability, and resilience of the Company's data processing systems and services.
- c.Regular monitoring for security breaches, and a process both for identifying and accessing reasonably foreseeable vulnerabilities in the Company's computer network and system, and for taking preventive, corrective, and mitigating actions against security incidents that can lead to a Personal Data breach.
- d.The ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident.
- e.A process for regularly testing, assessing, and evaluating the effectiveness of security measures.
- f.Encryption of Personal Data during storage and while in transit, authentication process, and other technical security measures that control and limit access thereto.
Rights of the Data Subject
As provided under the DPA, Data Subjects have the following rights in connection with the Processing of their Personal Data: right to be informed, right to object, right to access, right to rectification, right to erasure or blocking, and right to damages. Employees and agents of the Company are required to strictly respect and obey the rights of the Data Subjects. The DPO, with the assistance of HRD shall be responsible for monitoring such compliance and developing the appropriate disciplinary measures and mechanism.
Right to be Informed
The Data Subject has the right to be informed whether Personal Data pertaining to him or her shall be, are being, or have been processed.
The Data Subject shall be notified and furnished with information indicated hereunder before the entry of his or her Personal Data into the records of the Company, or at the next practical opportunity:
- a.Description of the Personal Data to be entered into the system.
- b.Purposes for which they are being or will be processed, including Processing for direct marketing, profiling or historical, statistical or scientific purpose.
- c.Basis of Processing, when Processing is not based on the consent of the Data Subject.
- d.Scope and method of the Personal Data Processing.
- e.The recipients or classes of recipients to whom the Personal Data are or may be disclosed or shared.
- f.Methods utilized for automated access, if the same is allowed by the Data Subject, and the extent to which such access is authorized, including meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing for the Data Subject.
- g.The identity and contact details of the DPO.
- h.The period for which the Personal Data will be stored.
- i.The existence of their rights as Data Subjects, including the right to access, correction, and to object to the Processing, as well as the right to lodge a complaint before the National Privacy Commission.
Right to Object
The Data Subject shall have the right to object to the Processing of his or her Personal Data, including Processing for direct marketing, automated Processing or profiling. The Data Subject shall also be notified and given an opportunity to withhold consent to the Processing in case of changes or any amendment to the information supplied or declared to the Data Subject in the preceding paragraph.
When a Data Subject objects or withholds consent, the Company shall no longer process the Personal Data, unless:
- 1.The Personal Data is needed pursuant to a subpoena;
- 2.The Processing is for obvious purposes, including, when it is necessary for the performance of or in relation to a contract or service to which the Data Subject is a party, or when necessary or desirable in the context of an employer-employee relationship between the Company and the Data Subject; or
- 3.The Personal Data is being collected and processed to comply with a legal obligation.
Right to Access
The Data Subject has the right to reasonable access to, upon demand, the following:
- 1.Contents of his or her Personal Data that were processed;
- 2.Sources from which Personal Data were obtained;
- 3.Names and addresses of recipients of the Personal Data;
- 4.Manner by which his or her Personal Data were processed;
- 5.Reasons for the disclosure of the Personal Data to recipients, if any;
- 6.Information on automated processes where the Personal Data will, or is likely to, be made as the sole basis for any decision that significantly affects or will affect the Data Subject;
- 7.Date when Personal Data concerning the Data Subject were last accessed and modified; and
- 8.The designation, name or identity, and address of the DPO.
Right to Rectification
The Data Subject has the right to dispute the inaccuracy or rectify the error in his or her Personal Data, and the Company shall correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable. If the Personal Data has been corrected, the Company shall ensure the accessibility of both the new and the retracted Personal Data and the simultaneous receipt of the new and the retracted Personal Data by the intended recipients thereof: Provided, That recipients or third parties who have previously received such processed Personal Data shall be informed of its inaccuracy and its rectification, upon reasonable request of the Data Subject.
Right to Erasure or Blocking
The Data Subject shall have the right to suspend, withdraw, or order the blocking, removal, or destruction of his or her Personal Data from the Company's filing system.
- 1.This right may be exercised upon discovery and substantial proof of any of the following:
- (a)The Personal Data is incomplete, outdated, false, or unlawfully obtained;
- (b)The Personal Data is being used for purpose not authorized by the Data Subject;
- (c)The Personal Data is no longer necessary for the purposes for which they were collected;
- (d)The Data Subject withdraws consent or objects to the Processing, and there is no other legal ground or overriding legitimate interest for the Processing by the Company;
- (e)The Personal Data concerns private information that is prejudicial to Data Subject, unless justified by freedom of speech, of expression, or of the press or otherwise authorized;
- (f)The Processing is unlawful; or
- (g)The Data Subject's rights have been violated.
- 2.The DPO may notify third parties who have previously received such processed Personal Data that the Data Subject has withdrawn his or her consent to the Processing thereof upon reasonable request by the Data Subject.
Transmissibility of Rights of Data Subjects
The lawful heirs and assigns of the Data Subject may invoke the rights of the Data Subject to which he or she is an heir or an assignee, at any time after the death of the Data Subject, or when the Data Subject is incapacitated or incapable of exercising his/her rights.
Data Portability
Where his or her Personal Data is processed by the Company through electronic means and in a structured and commonly used format, the Data Subject shall have the right to obtain a copy of such data in an electronic or structured format that is commonly used and allows for further use by the Data Subject. The exercise of this right shall primarily take into account the right of Data Subject to have control over his or her Personal Data being processed based on consent or contract, for commercial purpose, or through automated means. The DPO shall regularly monitor and implement the National Privacy Commission's issuances specifying the electronic format referred to above, as well as the technical standards, modalities, procedures and other rules for their transfer.
Data Breaches and Security Incidents
- Step 1:Reporting — As an internal security requirement, employees and authorized personnel shall report any suspected Personal Data Breach or Security Incident to the DPO within one (1) hour of discovery, or as soon as practicable under the circumstances.
- Step 2:Categorization — The BRT, with concurrence of the DPO, shall categorize the report as Security Incident, Personal Data Breach, or Non-Urgent Matter.
- Step 3:Investigation and Identification — If the report is either a Security Incident or Personal Data Breach, the DPO shall conduct immediate investigation to discover the nature and circumstances, system involved, and persons responsible, involved and affected.
- Step 4:Data Breach Notification — All employees and agents of the Company involved in the Processing of Personal Data are tasked with regularly monitoring for signs of a possible data breach or Security Incident. In the event that such signs are discovered, the employee or agent shall immediately report the facts and circumstances to the DPO within one (1) hour from his or her discovery for verification as to whether or not a breach requiring notification under the Data Privacy Act has occurred as well as for the determination of the relevant circumstances surrounding the reported breach and/or Security Incident. The DPO shall notify the National Privacy Commission and the affected Data Subjects pursuant to requirements and procedures prescribed by the DPA. Where a personal data breach meets the applicable mandatory notification criteria, ARIVA, as the Personal Information Controller, shall notify the National Privacy Commission and affected data subjects within seventy-two (72) hours upon knowledge of, or reasonable belief by ARIVA or its Personal Information Processor that, a personal data breach requiring notification has occurred. Notification shall be made based on available information and shall not await completion of the investigation, subject to applicable rules on permitted postponement. The DPO and designated alternate shall coordinate the notification and provide supplementary information as required.
- Step 5:Containment and Eradication — The BRT shall conduct steps to stop the cause of Security Incident or Personal Data Breach and its effects and make sure that it does not spread and cause further damage.
- Step 6:Recovery — The BRT shall endeavor to restore the system or application to a working state and take necessary actions to recover affected records, systems and other matters affected by the Security Incident.
- Step 7:Feedback — The BRT shall properly and officially categorize the status of the Security Incident or Personal Data Breach.
- Step 8:Learning — The BRT and pertinent departments of ARIVA shall discuss lessons learned and document such lessons to prevent similar incidents from occurring again.
Breach Reports
All Security Incidents and Personal Data breaches shall be documented through written reports, including those not covered by the notification requirements. In the case of Personal Data breaches, a report shall include the facts surrounding an incident, the effects of such incident, and the remedial actions taken by the Company. In other security incidents not involving Personal Data, a report containing aggregated data shall constitute sufficient documentation. These reports shall be made available when requested by the National Privacy Commission. A general summary of the reports shall be submitted by the DPO to the National Privacy Commission annually.
The NPC shall be notified when notification is required under the Data Privacy Act, its Implementing Rules and Regulations, and applicable NPC issuances. Mandatory notification generally applies when sensitive personal information or other information that may enable identity fraud is reasonably believed to have been acquired by an unauthorized person and the acquisition is likely to give rise to a real risk of serious harm to an affected Data Subject. Mandatory notification is required when all applicable criteria are met:
- The breach involves sensitive personal information or other information that may be used to enable identity fraud;
- There is reason to believe that the information was acquired by an unauthorized person; and
- The unauthorized acquisition is likely to give rise to a real risk of serious harm to an affected data subject, as determined under applicable NPC rules.
All security incidents and suspected personal data breaches shall be assessed and documented, whether or not external notification is required. Incidents that do not meet the mandatory notification criteria shall still be recorded and handled in accordance with ARIVA's incident-response procedures and applicable NPC reporting requirements.
Outsourcing and Subcontracting Agreements
Any Personal Data Processing conducted by an external agent or entity (third-party service provider) on behalf of the Company should be evidenced by a valid written contract with the Company. Such contract should expressly set out the subject matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and categories of Data Subjects, the obligations and rights of the Company, and the geographic location of the Processing under the contract.
The fact that the Company entered into such contract or arrangement does not give the said external agent or entity the authority to subcontract to another entity the whole or part of the subject matter of said contract or arrangement, unless expressly stipulated in writing in the same contract or evidenced by a separate written consent/agreement of the Company. The subcontracting agreement must also comply with the standards/criteria prescribed by the immediately preceding paragraph.
In addition, the contract and the subcontracting contract shall include express stipulations requiring the external agent or entity (including the subcontractor) to:
- A.Process the Personal Data only upon the documented instructions of the Company, including transfers of Personal Data to another country or an international organization, unless such transfer is required by law.
- B.Ensure that an obligation of confidentiality is imposed on persons and employees authorized by the external agent/entity and subcontractor to process the Personal Data.
- C.Implement appropriate security measures.
- D.Not engage another processor without prior instruction from the Company: Provided, that any such arrangement shall ensure that the same obligations for data protection under the contract or legal act are implemented, taking into account the nature of the Processing.
- E.Assist the Company, by appropriate technical and organizational measures, and to the extent possible, fulfill the obligation to respond to requests by Data Subjects relative to the exercise of their rights.
- F.Assist the Company in ensuring compliance with the Data Privacy Act and other issuances of the National Privacy Commission, taking into account the nature of Processing and the information available to the external party who acts as a Personal Information Processor as defined under the Data Privacy Act.
- G.At the choice of the Company, delete or return all Personal Data to it after the end of the provision of services relating to the Processing: Provided, that this includes deleting existing copies unless storage is authorized by the Data Privacy Act or other applicable laws or regulations.
- H.Make available to the Company all information necessary to demonstrate compliance with the obligations laid down in the Data Privacy Act, and allow for and contribute to audits, including inspections, conducted by the Company or another auditor mandated by the latter.
- I.Immediately inform the Company if, in its opinion, an instruction violates the Data Privacy Act or any other issuance of the National Privacy Commission.
Data Privacy
ARIVA and its official websites and online platforms, including ariva.com.ph / arivatalks.com / hrdacademy.ph / arivaacademy.asia adhere to applicable data privacy requirements and continuously improve this policy and related privacy practices and seek to follow appropriate privacy and security practices on protecting data privacy of all individuals. It is for this purpose that our commitment to regularly improve and update this policy and related issuances to address gaps. Your contribution is of great value to us. Please send us your comments and suggestions at arivaacademy@ariva.com.ph. Thank you.
Prepared by
EARL C. FLORES
Data Protection Officer
Approved by
MICHELLE IRISH MALONDA SAMSON
President
JM ARIVA MATIENZO
CEO
Consultant
Atty. James Earl Chew — Data Privacy Legal Council
Contact Information
Participants may raise questions, concerns, or requests regarding the processing of their Personal Data by contacting our Data Protection Officer:
Head Office: Betterliving Subdivision, Section 3, brgy. Don Bosco, Parañaque City, Philippines 1700. For comments or suggestions on this policy, you may also reach us at arivaacademy@ariva.com.ph.