Privacy Policy
At Upsourcing, protecting your data is fundamental to our mission and values. We recognize that trust is earned through transparency, responsible data handling, and strict adherence to privacy best practices. Our Privacy Policy serves as a cornerstone of this commitment, guiding how we collect, use, and protect information to maintain your confidence. By prioritizing privacy at every level of our operations, we strive to deliver a secure, reliable, and trustworthy experience for all our clients and partners.
1. Introduction
At Upsourcing (“the Company”), we are committed to protecting the privacy and security of personal data. We adhere to the highest data protection standards by complying with the Philippines’ Data Privacy Act of 2012 and the European Union’s General Data Protection Regulation (GDPR). This policy explains how we collect, use, store, and share personal information and describes your rights regarding your data. By interacting with our services, you acknowledge that you have read and understood this policy.
2. Scope
This Privacy Policy applies to all personal data processed by the Company, including data provided by customers, employees, suppliers, and website visitors. It covers both automated and manual processing activities regardless of the geographical location of the data subject.
3. Data Controller and Data Protection Officer
- Data Controller: Upsourcing is the data controller responsible for the processing of your personal data.
- Data Protection Officer (DPO): For questions or concerns about data privacy practices, please contact us at
Email: info@upsourcing.com.ph
Address: Unit S13 2nd Floor, Robertson Plaza, Centennial Rd. Tabon 1, Kawit, Cavite, Philippines
4. Principles of Data Processing
In processing personal data, we follow principles that reflect the core requirements of both the GDPR and the Data Privacy Act of the Philippines:
- Lawfulness, Fairness, and Transparency: Data is processed only for legitimate purposes, in a fair manner, and with full transparency.
- Purpose Limitation: Personal data is collected for specified, explicit, and legitimate purposes and is not further processed in a manner incompatible with those purposes.
- Data Minimization: We collect only data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
- Accuracy: We strive to ensure that personal data is accurate and kept up to date.
- Storage Limitation: Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected or as required by law.
- Integrity and Confidentiality: Appropriate technical and organizational measures are implemented to ensure the security and confidentiality of personal data.
5. Legal Basis for Processing
Our processing activities are based on one or more of the following legal grounds, in accordance with both the GDPR and the Data Privacy Act of the Philippines:
- Consent: When you have given explicit consent for us to process your personal data for a specific purpose.
- Contractual Necessity: Processing is necessary to fulfill contractual obligations.
- Legal Obligation: Processing required to comply with legal obligations.
- Legitimate Interests: Processing necessary for our legitimate interests, provided these interests do not override your fundamental rights and freedoms.
- Public Interest: Where applicable, processing that is necessary for tasks carried out in the public interest or in the exercise of official authority.
6. Categories of Personal Data
Depending on the nature of our interactions, we may process the following categories of personal data:
- Identification Data: Name, address, email, phone number, and identification numbers.
- Transactional Data: Payment details, purchase history, and service usage data.
- Technical Data: IP addresses, browser types, operating systems, and device information.
- Communications Data: Records of correspondence and communications with our customer service teams.
- Special Categories of Data: In exceptional cases (with explicit consent and necessary safeguards), sensitive data such as health information may be processed.
7. Data Collection Methods
We collect personal data through various channels, including:
- Direct Interactions: Via forms, email, telephone calls, and in-person interactions.
- Automated Technologies: Through cookies, web beacons, and similar tracking technologies on our website.
- Third Parties: When personal data is provided by trusted third-party partners, subject to appropriate safeguards.
8. Use of Personal Data
Personal data is used for the following purposes:
- Service Delivery: To provide, maintain, and improve our products and services.
- Customer Support: To manage inquiries, provide technical support, and respond to customer service requests.
- Marketing and Communications: With your consent, to send promotional materials, newsletters, and updates.
- Compliance and Legal Obligations: To comply with legal requirements and to enforce our policies.
- Analytics and Research: To analyze trends and improve our services. Where possible, data used for analytics is anonymized or aggregated.
9. Data Sharing and Third Parties
We may share your personal data with third parties under the following circumstances:
- Service Providers: Third-party vendors and partners who assist in delivering our services, provided they comply with data protection agreements.
- Legal Compliance: When required by law, regulation, or legal process.
- Business Transfers: In connection with mergers, acquisitions, or asset sales, ensuring that the receiving party adheres to applicable data protection laws.
- Consent-Based Sharing: When you have provided explicit consent for sharing your personal data with specific parties.
10. Data Security Measures
We implement robust technical and organizational measures to safeguard your personal data against unauthorized access, loss, or alteration. These measures include, but are not limited to:
- Encryption: Personal data is encrypted during transmission and when stored.
- Access Controls: Strict access controls and authentication procedures.
- Regular Audits: Periodic reviews and audits of our data security practices.
- Employee Training: Ongoing training and awareness programs for our staff on data protection best practices.
11. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable laws. Requests for deletion, correction, or restriction of processing will be handled in accordance with our internal procedures and legal obligations under both the GDPR and the Data Privacy Act of the Philippines.
12. Data Subject Rights
Under both the GDPR and the Data Privacy Act of the Philippines, you have the following rights with respect to your personal data:
- Right to Access: Request confirmation as to whether your personal data is being processed and obtain a copy of that data.
- Right to Rectification: Request corrections to any inaccurate or incomplete personal data.
- Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data under certain conditions.
- Right to Restrict Processing: Request that the processing of your data be restricted.
- Right to Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format.
- Right to Object: Object to the processing of your personal data, including for direct marketing purposes.
- Right to Withdraw Consent: Withdraw your consent at any time where processing is based solely on consent, without affecting the lawfulness of processing prior to withdrawal.
To exercise any of these rights, please contact our DPO using the contact details provided above. We will respond to your request in a timely manner and in accordance with applicable legal requirements.
13. International Data Transfers
Where personal data is transferred outside of the European Economic Area (EEA) or the Philippines, we will ensure that appropriate safeguards are in place. This may include the use of Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or other approved mechanisms to ensure that your data remains protected in accordance with applicable laws.
14. Data Breach Notification
In the unlikely event of a data breach that could result in a risk to your rights and freedoms, we will notify the appropriate supervisory authorities without undue delay. Where required by applicable
15. Changes to This Policy
We reserve the right to update or modify this Data Privacy Policy from time to time. Any significant changes will be communicated via our website or through other appropriate channels. The revised policy will be effective immediately upon its publication, and your continued use of our services constitutes acceptance of the updated terms.
15. Changes to This Policy
We reserve the right to update or modify this Data Privacy Policy from time to time. Any significant changes will be communicated via our website or through other appropriate channels. The revised policy will be effective immediately upon its publication, and your continued use of our services constitutes acceptance of the updated terms.
16. Contact Information
For any questions, concerns, or requests regarding this Data Privacy Policy or your personal data, please contact:
- Data Protection Officer:
Email: [dpo@yourcompany.com]
Address: [Your Company’s Address]
Telephone: [Your Company’s Contact Number]
Last Updated: 18 February 2025
This policy reflects our ongoing commitment to ensuring data privacy and maintaining compliance with both the GDPR and the Data Privacy Act of the Philippines. We continuously review and update our practices to safeguard your personal data while balancing the operational needs of our business. It is recommended that this policy be reviewed by legal counsel to ensure it meets the specific requirements and circumstances of your organization.