Privacy Policy & Data Protection Notice
In full compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and relevant issuances of the National Privacy Commission (NPC).
1. Our Privacy Commitment & Statutory Scope
TheTownship ("we", "us", or "our") operates as a Personal Information Controller (PIC) under Republic Act No. 10173 (Data Privacy Act of 2012 / DPA). We are committed to upholding your privacy rights, guaranteeing transparency, honoring legitimate purposes, and ensuring proportional processing of all personal data entrusted to us by members, club administrators, organizers, and visitors.
Data Protection Officer (DPO) Designation & NPC Registration
In compliance with Section 21(b) of R.A. 10173 and NPC Advisory No. 17-01, TheTownship has formally appointed a designated Data Protection Officer (DPO). Formal registration of our Data Protection Officer and Data Processing Systems with the National Privacy Commission Registration System (NPCRS) is currently in process. You may direct any questions, data subject requests, or privacy concerns to our DPO at jam@thetownship.app.
2. Information We Collect
We collect information directly from you when you register an account, join a club, complete an onboarding profile, participate in elections, or execute financial transactions:
A. General Personal Information
- Full name (first, middle, last name)
- Email address and telephone / mobile numbers
- Mailing / residential address
- Emergency contact person and contact numbers
- Company name, industry, job position, and professional skills
- Profile photos, avatars, and personal bio
- Social media links (e.g., LinkedIn URL)
B. Sensitive Personal Information (SPI)Sec. 13 DPA
- Date of Birth & Age (used for age verification and alumni batching)
- Educational Background: School/college, graduation year, grade, and section
- Government Identifiers: Taxpayer Identification Number (TIN) and BIR Form 2307 certificates (solely for official receipts and billing)
- Election Ballots: Confidential voting selections in club elections (cryptographically isolated)
C. Technical & Diagnostic Telemetry
Internet Protocol (IP) addresses, browser type, device identifiers, session timestamps, and immutable activity audit logs recorded to ensure system integrity, prevent fraud, and satisfy legal audit trails.
3. Lawful Basis and Purpose of Processing
We process personal information only in strict adherence to the principles of Transparency, Legitimate Purpose, and Proportionality under the following lawful criteria (Sections 12 and 13 of R.A. 10173):
Fulfillment of Contract & Community Services: To register accounts, verify club affiliations, facilitate group collaboration, organize event ticketing, process dues and donations, and deliver community notifications.
Explicit Consent: Where you have opted in to receive mentorship connections, marketing newsletters, or when providing optional sensitive background information.
Compliance with Statutory Obligations: Generating official BIR-compliant VAT/Non-VAT invoices, maintaining financial records under the National Internal Revenue Code (NIRC), and cooperating with lawful government mandates.
Legitimate Interests: Protecting the security and confidentiality of member accounts, debugging issues, preventing brute-force attacks, and optimizing platform performance.
4. Artificial Intelligence & Automated Processing
TheTownship integrates Generative AI assistance (powered by Google Cloud Vertex AI / Google Gemini) to empower club organizers with drafting club announcements, summarizing meeting minutes, and generating event insights.
Privacy Protection Guarantees for AI Features:
- Your prompts and club content are processed ephemerally via enterprise-grade Google Cloud API endpoints.
- No Model Training: Your inputs, personal data, and club data are NOT used to train, retrain, or improve Google's public foundation models.
- AI assistance is strictly assistive and opt-in for administrators; no automated profiling decisions impacting your legal rights are performed without human intervention.
5. Third-Party Sub-processors & International Data Transfers
Under Section 14 and Section 21 of R.A. 10173, TheTownship remains responsible for personal data shared with verified Personal Information Processors (PIPs). All vendors operate under binding Data Processing Agreements (DPAs) and industry-recognized security controls:
| Vendor / Service | Role & Purpose | Hosting Location | Safeguards & Compliance |
|---|---|---|---|
| Google Cloud Platform (GCP) | Application compute, database hosting, Cloud Run, Cloud Tasks | Global / Regional Data Centers | SOC 2/3, ISO 27001, Google Cloud CDPA, AES-256 encryption |
| Firebase Storage (Google) | Secure asset storage (avatars, event banners, payment receipts) | Global / Regional Data Centers | Encrypted at rest, tokenized private URLs, Google Cloud CDPA |
| Google Gemini API | Assisted text generation & announcement drafting | Enterprise Cloud Regions | Strict zero-training policy on customer prompts, TLS 1.3 |
| Redis Cloud (Redis Ltd.) | In-memory caching, rate-limiting, and WebSocket chat broker | Cloud Regions | SOC 2 Type II, ephemeral storage, TLS in transit |
| Brevo (formerly Sendinblue) | Transactional emails, password reset tokens, OTP verification | European Union (France/Germany) | GDPR Compliant, ISO 27001, Standard Contractual Clauses (SCCs) |
Where data is processed outside the Philippines, we ensure that foreign processors provide a standard of data protection comparable to that mandated by Republic Act No. 10173.
6. Data Retention and Disposal Policy
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with statutory retention laws:
Retained for the lifetime of your active club membership or until you request account deletion.
Ephemeral chat room messages and transient cache records are automatically purged after 90 days.
Invoices, payment ledgers, and Form 2307 records are preserved for ten (10) years pursuant to Bureau of Internal Revenue (BIR) regulations.
7. Rights of the Data Subject (Your Privacy Rights)
Under Chapter IV (Sections 16, 17, and 18) of the Data Privacy Act of 2012, you possess the following statutory rights:
How to Exercise Your Rights
You may update your information at any time via your Profile Settings. To request an official export (Data Portability) or request account erasure, email our Data Protection Officer at jam@thetownship.app with the subject line "Data Subject Request - [Your Name]". We will verify your identity and respond within thirty (30) calendar days.
8. National Privacy Commission (NPC) Recourse
If you believe that your personal data has been unlawfully collected, misused, compromised, or that TheTownship has failed to adequately address your data subject request, you have the statutory right to lodge a complaint before the National Privacy Commission (NPC):
National Privacy Commission Contact Details:
📍 Address: 5th Floor, Delegation Building, PICC Complex, Vicente Sotto Avenue, Pasay City, Metro Manila 1307
🌐 Website: privacy.gov.ph
✉️ Complaints Email: complaints@privacy.gov.ph
📞 Helpdesk Email: info@privacy.gov.ph
9. Minors and Parental Consent
Our Services are not designed for unsupervised minors under 18 years of age. If an educational club, school organization, or youth team registers minors, verifiable consent from a parent or legal guardian must be provided prior to account activation. Parents or legal guardians may review, edit, or request the deletion of their child's personal records by contacting our DPO.
10. Contacting Our Data Protection Officer
Designated Officer: Office of the Data Protection Officer
Official Email: jam@thetownship.app
Office Address: Carmen, Cagayan de Oro City, Misamis Oriental, 9000, Philippines
We periodically review this policy to ensure continuing alignment with NPC advisories and evolving legal frameworks. Revisions take effect immediately upon publication.