Privacy Notice and Request for Consent for the Processing of Personal Data

(Shipping Order Form)

Pursuant to Chapter III of the Republic Act 10173 of 30 June 2003 “An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes” (hereinafter also referred to as the “Data Privacy Act of 2012”) and its Implementing Rules and Regulations (IRR) we hereby provide you with information regarding the processing of your personal data.

1. Personal Information Controller
   Your personal data will be processed, depending on the purposes as specified in Section 3 below, “Purposes of the processing of the personal data,” by the following in its capacity as personal information controllers:
   • MBE PH – that is the entrepreneur as specifically identified in the Shipping Order Form to which said Privacy Notice is attached.

2. Categories of Personal Information Processed
   1. Personal information provided by you voluntarily
      Please note that personal data you provide directly are subject to processing. Personal information means “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”, this including photos (Sec. 3. (g) of the Data Privacy Act of 2012 and Sec. 3 (j) of its IRR).
   2. Personal data of third parties provided by you voluntarily
      You take note that any indication (for example, in the filling in of the Shipping Order Form and/or of electronic forms via the Internet or any other forms by you and/or by the MBE PH) of personal information and of contact of any other data subject within the scope of the shipping service is a case of processing of personal information where you act as Personal Information Controller with respect to the aforesaid subjects. Therefore, you, in the capacity of Personal Information Controller of personal and contact information, shall guarantee that such data is collected and communicated in compliance with the relevant provisions. To that end, you undertake and guarantee, pursuant to Section 11 of the Data Privacy Act of 2012 and Section 34(a) of its IRR, to inform the said subjects whose personal data are collected and communicated in relation to the procedures, period and purposes of the processing. The personal data of the said subjects shall be communicated for the sole purpose of the shipment and related management.

3. Purpose of the processing of the personal data
   Your personal data will be processed, with your prior explicit consent where necessary, by the MBE PH, depending on the purposes pursued in the capacity of Personal Information Controller.
   1. Purpose of the processing of the personal data by the MBE PH
      The MBE PH will process your personal data for:

      3.1. Purposes of the processing of the personal data by the MBE PH
      	Processing	Legal basis for the processing	Consequences of the failure to provide personal data
      i	Processing for purposes related to the performance and management of the requested MBE Service, as well as management of the related payments, complaints and communications with the Customer; where applicable, also for processing relating to the verification of customers and other legal requirements.	The legal basis for the processing of personal data is your specific consent shown in the contract to which the Customer is a party in order to enable the performance and management of the requested MBE Service. On the other hand, certain obligations (for example, those of fiscal nature or those of verification of customers in the context of domiciliation services) are mandatory at law.	The provision of personal data (and/or personal data of any third party, to the extent this is necessary for the performance and management of the requested MBE Service; for example: in the case of shipment services, the contact data of the person to whom the parcel is sent) is optional, however, failure to provide such data will make it impossible to perform and manage the requested MBE Service.
      ii	Processing for general marketing purposes, i.e. to send the Customer, by any means of communication (fax, e-mail, sms, mms, paper mail, telephone calls with operator or other channels), advertising and information materials of a promotional nature or, in any case, of commercial solicitation with regard to services, products or discounts of the MBE PH, as well as to prepare studies, research and market analyses.	The legal basis for the processing of personal data is the consent of the Customer.	The provision of personal data is optional, and failure to do so will only make it impossible for the MBE PH to send advertising and promotional messages and carry out market research. This will not affect the performance and management of the requested MBE Service.
      iii	Profiling for direct marketing purposes, concerning individual customers or groups of customers to allow to assess, analyze or predict personal preferences regarding the value and type of the purchased MBE Service or its frequency of use in order to offer further services, products or discounts (such as shipment, graphics and printing services, domiciliation, communication, etc.).

   2. Further clarifications on consent
      We further point out that, if you have given consent authorizing the MBE to pursue the purposes, respectively, as per Section 3.1 above, you will remain in any case free to revoke at any time the consent and/or to object to the processing of the data for the aforesaid purposes, by sending without any formalities, a clear written communication to that effect to the addresses as specified in Section 10 below, “Contacts for the exercise of the rights of the data subject and for further information.”

      As for the exercise of the right to object for purposes of marketing, we inform you that if exercised by you, it will regard all means of contact, whether electronic, automated or traditional, but you have the power to exercise your right to object to the limited extent of just some contact channels. For example, at any time by contacting the relevant Personal Information Controller at the addresses as specified in Section 10 below, “Contacts for the exercise of the rights of the Data Subject and for further information,” you may object to just the sending of promotional communications by automated means (that is, contact by e-mail, text message, multimedia messaging service, etc.) and thus give your consent solely to receiving communication by traditional means (that is, paper-based mail or operator-assisted phone calls).

      Following receipt of such application for revocation and/or expression of objection, the MBE PH will proceed timely to the deletion and erasure of your personal data from the database and inform, where possible, any third parties to whom or which the data have been communicated for the same purpose of cancellation.

4. Modalities of processing of personal data
   The processing of your personal data will be done by means of manual and IT devices, as well as paper. The personal data provided by you will not be subject to automated decision-making processes, with the exception of profiling as per Section 3.1 (iii) above.

5. Recipients of personal data
   Your personal data, which will not disseminated by MBE PH, may be communicated:

    

   from the MBE PH to:

   (i) employees, agents or collaborators of the MBE PH that are located within the territory of the Philippines and/or country of destination of the service;

   (ii) subjects that engage in activities of assistance and consultation on behalf of the MBE PH in accountancy, administrative, legal, tax and financial matters that are located within the territory of the Philippines and/or country of destination of the service;

   (iii) subsidiaries or associated companies

   (iv) third parties with which – from time to time – commercial partnership agreements and/or common initiatives, campaigns and projects will be developed, which are located within the territory of the Philippines and/or country of destination of the MBE service and operate in the following industries: information and other computer services (data processing, hosting and related activities; web portals; other information service activities); (i) land transport and pipeline transport (rail freight transport; road freight transport and moving services); (ii) maritime and waterborne transport (maritime and coastal freight transport; inland waterway transport of goods); (iii) air transport (air freight and space transport); (iv) warehousing and transport support activities (warehousing and storage; transport support activities); (v) postal services and courier activities (postal activities with universal service obligation; other postal and courier activities); electricity, gas, steam and air conditioning supply (electricity generation, transmission and distribution of electricity; gas production and distribution of gaseous fuels by pipelines); telecommunications (land telecommunications; mobile telecommunications; satellite telecommunications; other telecommunications activities); in advertising and market research (advertising; market research and opinion polling);

   (v) persons, companies or professional offices located within the territory of the Philippines and/or country of destination of the MBE service that engage in activities of assistance and consultation in accountancy, administrative, legal, tax and financial matters;

   (vi) subjects, bodies or authorities to whom or which the communication of your personal data is mandatory by virtue of provisions of law or orders issued by authorities;

   The subjects or categories of subjects to whom or which your personal data will be communicated by the MBE PH may process your personal data in the capacity of data processors, autonomous Personal Information Controller or joint Personal Information Controller.

   The complete list of the data processors:
   – of the MBE PH is available at its registered office; for more information, you may apply in writing at the addresses specified in Section 10 below, “Contacts for the exercise of the rights of the data subject and for further information.”

6. Transfer of personal data outside PH
   Your personal data and those of the consignees will not be transferred outside the Philippines, unless it is necessary for the performance of that certain services (e.g. international shipments). In any case, each personal information or data controller has the right to transfer your Personal Data to third countries. Transfers of data outside the Philippines are still subject to Data Privacy Act of 2012, and are only made in respect of countries that ensure an adequate level of personal data protection, on the basis of an adequacy decision of the Commission or where adequate safeguards have been adopted, provided that the data subjects have enforceable rights and effective judicial remedies.

7. Retention of personal data
   In application of the principle of proportionality, we inform you that:
   • the MBE PH will retain the personal data for a period not exceeding what is necessary to pursue the purposes specified in paragraph 3.1. (i) (execution and management of the requested MBE Service), without prejudice to any specific legal obligations with regard to the retention of accountancy documents; save for the right of the Customer to withdraw its consent at any time where it constitutes the legal basis for the processing;
   • the MBE PH, for the purpose as per Section 3.1 (ii) above (marketing), and (iii) profiling above, will retain your personal data for a period no longer than twenty-four months from the time of their recording, save for anonymization which prevents, even indirectly or in aggregate with other databases, the identification of the data subject; save for the right of the Customer to withdraw its consent at any time where it constitutes the legal basis for the processing;

   The criteria for determining the retention period of the personal data take into account the processing period allowed at law, the applicable laws on the statute of limitation of rights and the legitimate interests of the data subject, where they are the applicable legal basis for processing.

   MBE PH have implemented suitable mechanisms for automatic erasure of personal data, including to any third party to whom or which such data might have been communicated.

   Following the above retention periods, personal data will be deleted, aggregated or anonymized.

8. Exercise of rights by the data subject
   Pursuant to Section 16 of the Data Privacy Act of 2012, as well as pursuant to Section 34 (a)(b)(c)(d)(e) and (f) of its IRR, we inform you that:

    

   • you have the right to be informed of the collection, procedures, period, scope and methods used in personal data processing, as well as the existence of your rights including the right to access, correction, and object to the processing, as well as the right to lodge a complaint before the National Privacy Commission;
   • you have the right to apply to the Data Process Controller for reasonable access to the personal data, the rectification or deletion of the same or restriction on the processing as concerns you, and to object to such processing, or to revoke consent, in addition to the right to portability of the data;
   • you have a right to lodge a complaint with the National Privacy Commission, following the procedures and instructions published on the official website of the same national privacy authority at https://privacy.gov.ph/filing-a-complaint/;
   • any rectification or deletion or restriction on processing done at your request, unless it proves to be impossible or entails a disproportionate effort, will be communicated by the Personal Information Controller (s) to each of the recipients to whom or which your personal data have been transmitted. The Personal Information Controller (s) may communicate such recipients to you should you expressly so request.
     Your applications for the exercise of such rights shall be addressed in writing to the Personal Information Controller (s) at the addresses as specified in Section 10 below, “Contacts for the exercise of the rights of the data subject and for further information.”

      

     The exercise of the rights is not subject to any formal restriction and is free of charge. For ease of reference, we reproduce below the text of Section 16 of the National Privacy Act of 2012:SEC. 16. Rights of the Data Subject. – The data subject is entitled to:

     • Be informed whether personal information pertaining to him or her shall be, are being or have been processed;
     • Be furnished the information indicated hereunder before the entry of his or her personal information into the processing system of the personal information controller, or at the next practical opportunity:
       1. Description of the personal information to be entered into the system;
       2. Purposes for which they are being or are to be processed;
       3. Scope and method of the personal information processing;
       4. The recipients or classes of recipients to whom they are or may be disclosed;
       5. Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;
       6. The identity and contact details of the personal information controller or its representative;
       7. The period for which the information will be stored; and
       8. The existence of their rights, i.e., to access, correction, as well as the right to lodge a complaint before the Commission.
          Any information supplied or declaration made to the data subject on these matters shall not be amended without prior notification of data subject: Provided, That the notification under subsection (b) shall not apply should the personal information be needed pursuant to a subpoena or when the collection and processing are for obvious purposes, including when it is necessary for the performance of or in relation to a contract or service or when necessary or desirable in the context of an employer-employee relationship, between the collector and the data subject, or when the information is being collected and processed as a result of legal obligation;
     • Reasonable access to, upon demand, the following:
       1. Contents of his or her personal information that were processed;
       2. Sources from which personal information were obtained;
       3. Names and addresses of recipients of the personal information;
       4. Manner by which such data were processed;
       5. Reasons for the disclosure of the personal information to recipients;
       6. Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject;
       7. Date when his or her personal information concerning the data subject were last accessed and modified; and
       8. The designation, or name or identity and address of the personal information controller;
     • Dispute the inaccuracy or error in the personal information and have the personal information controller correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable. If the personal information have been corrected, the personal information controller shall ensure the accessibility of both the new and the retracted information and the simultaneous receipt of the new and the retracted information by recipients thereof: Provided, That the third parties who have previously received such processed personal information shall he informed of its inaccuracy and its rectification upon reasonable request of the data subject;
     • Suspend, withdraw or order the blocking, removal or destruction of his or her personal information from the personal information controller’s filing system upon discovery and substantial proof that the personal information are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected. In this case, the personal information controller may notify third parties who have previously received such processed personal information; and
     • Be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.
       For more information about the provisions contained in Section 34 (a)(b)(c) (d) (e) and (f) of its
       IRR, click on the following link: https://www.privacy.gov.ph/wp-content/uploads/2016/07/updated-draft-July-12-2016.pdf

9. Contacts for the exercise of the rights of the data subject and for further information
   With respect to the exercise of your rights in relation to the purposes as per section 3.1 above and/or to obtain any type of information you may need in relation to the MBE PH pursuant to this Privacy Notice, you may send a written communication to its registered office at 1953-55 M. Adriatico St., Malate, Manila or an email to dataofficer@mbe.ph

10. Consent to the processing of personal data
    The undersigned, ___________________________________ (first name and surname in capital letters), born on __________________ (date of birth)
    Declare to have been duly informed of the nature, scope and consequences of the processing of my personal data for purposes of the execution and management of shipments, as well as for other specified purposes, pursuant to Section 16 of the Data Privacy Act of 2012, as well as pursuant to Section 34 (a)(b)(c) (d) (e) and (f) of its IRR,; as well as of ii) my rights with respect to my personal data;

SIGNATURE OVER PRINTED NAME _____________________

DATE __________________
SIGNATURE OVER PRINTED NAME __________________________