XURPAS GROUP PRIVACY POLICY

This Privacy Policy is effective as of 30 May 2024. Please note that this Privacy Policy will regularly be updated to reflect any changes in the way we handle your personal data or any changes in applicable laws.

Xurpas Inc., Xurpas Enterprise Inc., Xurpas Software Inc., Xurpas AI Lab, Xurpas Pty. Ltd.   (“Company”, “we”, “us”, or “our”) respect and value your privacy. We are committed to complying with the Republic Act No. 10173 also known as the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulation (“IRR”), other relevant laws of the Philippines and issuances of the National Privacy Commission (“NPC”), and the General Data Protection Regulations(“GDPR”) (collectively, the “Privacy Laws”), including our internal Company data privacy and protection policies, which we have adopted internally.

Our Privacy Policy outlines how the Company (i) collect; (ii) process; (iii) use; (iv) store; (v) disclose; (vi) transfer, and (vii) dispose of the personal data that you provide, alongside the measures implemented to safeguard this data and ensure its security. Additionally, it covers the steps taken to uphold and respect the rights of data subjects.

• COLLECTION OF PERSONAL DATA

  On occasion, you may find it necessary to provide Personal Data for a variety of activities, including accessing our company website and portals (which involves browsing any of our websites or mobile applications), visiting our physical offices, participating in events organized or sponsored by our company, and engaging in direct or indirect interactions with our company, officers, and employees in roles such as investor, shareholder, job applicant, employee, stakeholder, or customer. This also extends to participating in polls and surveys sent via electronic emails. As part of our routine IT operations, and to adequately address your requests, inquiries, and concerns, we may gather and process various forms of personal data. This encompasses:

  1. Basic Information. Name, residence, and contact details.
  2. Sensitive Personal Information.  Age, financial information, biometric data, birthdate, educational background, ID with picture, employment history, gender, government-issued identifications, licenses, and certifications.
  3. Other Details. Marital status, photograph, place of birth, legal proceedings for any offenses committed or alleged, signatures, social security number, tax identification number, tax returns, and other similar details.
     

     CCTV Monitoring

     Our offices are equipped with CCTV cameras for security and safety purposes. The footage recorded by these cameras is used to monitor and ensure the safety of our premises, personnel, and visitors. Access to CCTV footage is restricted to authorized personnel only and is handled in compliance with applicable Privacy Laws. Recorded footage is stored securely and retained for a limited period, after which it is automatically deleted, unless required for an ongoing investigation or legal proceedings. By entering our premises, you consent to being recorded by our CCTV cameras.

     Website and Mobile Application Data

     When you visit our websites or use our mobile applications, we may also collect:

     1. Technical Information.  Browser type, operating system, IP address, domain name, number of times the website or mobile application was accessed, and frequency of access, collected via cookies and other tracking technologies like transparent GIF files.
     2. Aggregate Information. Non-personally identifiable and anonymous data, such as the frequency of logins to our websites or mobile applications, which is useful for the improved management and optimization of our data systems and electronic mail communications.

     By using our services, you consent to the collection and use of your personal data as outlined in this Privacy Policy.

     Use of Cookies and Tracking Technologies

     We use cookies to collect information about your computer to enhance our services and provide statistical data regarding the usage of our website. This information is aggregated and anonymous, ensuring that it does not identify you personally. It helps us understand how visitors use our website, enabling us to improve its functionality and the services we offer.

     Cookies also gather information about your general Internet usage. These cookies are automatically downloaded to your computer and stored on your hard drive, containing data that helps improve our website and services.

     If you prefer, you can decline cookies by adjusting the settings on your browser. However, please be aware that declining cookies may limit your ability to access certain parts of our website.

• PROCESS OF PERSONAL DATA

  Our processing of your Personal Data involves collecting, storing, and recording it in both digital and physical formats. Access to this information is restricted to authorized personnel only, primarily for facilitating your engagement and transactions with us. Additionally, we may organize or consolidate your Personal Data for the stated purposes, and upon your request, retrieve, update, modify, or correct any stored data accordingly.

• USE OF PERSONAL DATA

  We use your Personal Data, when needed, to better grasp your requirements and improve our service. We handle this data for specific purposes only in compliance with Privacy Laws.

  As an investor or stockholder, we verify your identity to provide services, manage transactions, handle dividends, and maintain accurate records. We also analyze collective investor data, conduct statistical analysis, and address inquiries effectively.

  As a stakeholder, we meet due diligence requirements, regulatory obligations, and legal processes while maintaining correspondence.

  As a customer, we manage your information for inquiries, contracts, service enhancement, promotions, and record maintenance.

  As an employee, we use your data for compensation, career advancement, safety standards, engagement, and legal compliance.

  As a job applicant, we authenticate your identity and qualifications.

• STORAGE AND RETENTION OF PERSONAL DATA

  The Company will retain Your Personal Data only for as long as necessary for the purposes outlined in this Privacy Policy. This includes retention and use of Your Personal Data to comply with legal obligations, resolve disputes, and enforce legal agreements and policies. Additionally, Usage Data will be retained for internal analysis purposes, typically for a shorter period, unless required for security enhancements or legal obligations. Organizational, physical, and technical security measures are consistently maintained by the Company  to ensure the integrity, confidentiality, and security of your personal information. These measures include limiting the processing of personal information to the extent necessary for delivering the Company’s Services, employing firewall, data encryption, anti-virus, and other relevant security controls on our servers, restricting access to authorized personnel on a need-to-know basis, conducting regular audits to ensure effectiveness of security controls, keeping security systems up to date, regularly orienting personnel on data privacy protection, and securely storing your personal information within our office facility.

• DISCLOSURE OF PERSONAL DATA

  Your Personal Data may be shared with the Company’s affiliates or subsidiaries for a range of purposes, such as processing, documentation, profiling, and customer insights, to facilitate cross-selling efforts among them. This sharing may be noted in future communications or transactions.

  Additionally, your Personal Data may be disclosed or shared with third parties to achieve these purposes, following data sharing agreements or similar documents outlining the sharing arrangement. These third parties may include agents, contractors, subcontractors handling stockholder services; consultants, advisers, auditors, or service providers engaged for legitimate business activities; affiliates, subsidiaries, partner companies, and service providers contracted through data sharing agreements for customer attraction or retention programs, data analytics, and other commercial and marketing purposes. Your Personal Data may also be shared with courts, government agencies, lenders, creditors, underwriters, legal representatives, and regulatory authorities as necessary for legitimate business purposes or pursuant to lawful orders.

  Access to Personal Data will be limited to those who need it for specific tasks, and we strictly follow Privacy Laws regarding data sharing. We do not sell, trade, or transfer Personal Data to third parties without proper data sharing agreements in place. Any sharing for commercial purposes is guided by these agreements, and we will seek your consent beforehand or ensure compliance with Privacy Laws as required.

• TRANSFER OF PERSONAL DATA

  Your data, including Personal Data, undergoes processing at the Company’s operational offices and other locations where processing parties operate. This implies potential transfer and storage of information on computers situated beyond your jurisdiction, where data protection laws may vary. Your consent to this Privacy Policy, coupled with your provision of such information, signifies your acceptance of this transfer. The Company is committed to ensuring your data’s security and compliance with this Privacy Policy. No transfer of your Personal Data occurs unless adequate controls are established, including data and personal information security measures, in the receiving organization or country.

• DISPOSAL OF PERSONAL DATA

  We employ suitable disposal procedures, both physical and electronic, for documents, records, and assets to securely discard Personal Data. This prevents unauthorized access, disclosure to third parties or the public, and safeguards the interests of data subjects. Your Personal Data will be retained only as long as necessary for legitimate business purposes, in accordance with the principle of proportionality, to adhere to laws or regulations, comply with lawful court orders, or establish or defend legal actions.

• RIGHTS OF DATA SUBJECT

  In accordance with the Data Privacy Law, we shall respect and uphold your rights as data subjects. Under the DPA, you have the right to be informed regarding processing the personal information we hold about you.
  Further, you may be entitled to request:

  1. Access to personal data we process about you. It is your right to obtain confirmation on whether or not data relating to you are being processed;
  2. Rectification of your personal data. This is your right to have your personal data corrected if it is inaccurate or incomplete;
  3. Erasure or order blocking of your personal data whenever warranted;
  4. The right to object if the personal data processing involved is based on consent or on legitimate interest;
  5. The right to data portability through which you may obtain and electronically move, copy, or transfer your data securely for further use.
  6. You have the right to correct or dispute any inaccuracy or error in your personal data and request to correct it, unless such request is unreasonable.
  7. You may file a complaint if you are the subject of a privacy violation or personal data breach, or who are personally affected by a violation of the Privacy Laws.
  8. You may claim compensation if you suffered damages due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of Personal Data

• CONTACT DETAILS

  If you have any inquiries, concerns, complaints, or suggestions regarding our adherence to Privacy Laws, or if you want to exercise your rights to access, rectify, object, transfer, or delete data as permitted by law, please reach out to our Data Privacy Officers:

  Xurpas Group Data Protection Officers

  Data Protection Officers	Entity	Email
  Ella C. Malapitan	Xurpas Inc./XEI/XAIL	dpo@xurpas.com
  Ella C. Malapitan	XEI/XAIL	dpo.xe@xurpas.com
  Antonio Ancheta	XSI	xsi.dpo@xurpas.com