Privacy Policy

1. Who We Are

Powerbyte IT Solutions ("we", "us", "our") is the Personal Information Controller (PIC) for all personal data processed through the Orqafy platform. We are registered with and subject to the jurisdiction of the National Privacy Commission (NPC) of the Philippines.

Data Protection Officer contact: [email protected]

2. What Data We Collect

We collect and process the following categories of personal data:

• Identity data: Full name, display name, employee number, government IDs (as required by Philippine labour law).
• Contact data: Email address, phone number.
• Employment data: Department, position, employment status, attendance records, leave requests, payroll and compensation data.
• System data: Login timestamps, IP addresses, audit log entries (actions performed within the platform).
• Financial data: Bank account details, payroll amounts, expense claims (where applicable).

3. Lawful Bases for Processing

We process your personal data on the following lawful bases under Section 12 of RA 10173:

• Contractual necessity: Processing is required for the performance of your employment contract or the service agreement between your organisation and Powerbyte IT Solutions (Section 12[b]).
• Legal obligation: Processing is required to comply with applicable Philippine laws (e.g., BIR, SSS, PhilHealth, Pag-IBIG reporting obligations) (Section 12[c]).
• Legitimate interests: Processing for platform security, fraud prevention, and audit log maintenance, where these interests are not overridden by your rights (Section 12[f]).

4. Your Rights Under RA 10173

As a data subject you have the following rights under the Philippine Data Privacy Act (Sections 16–18, 34):

1. Right to be informed — You have the right to know whether your personal data is being, has been, or will be processed, and to receive information about how it is used.
2. Right to access — You may request a copy of your personal data that we hold about you.
3. Right to rectification — You may request correction of inaccurate or incomplete personal data.
4. Right to erasure or blocking — You may request that we erase or block your personal data. Note: ERP and payroll records are subject to statutory retention periods (see Section 5 below); such requests are reviewed, not acted on automatically.
5. Right to data portability — You may request your personal data in a structured, commonly used, machine-readable format (Section 18).
6. Right to object — You may object to processing of your personal data for specific purposes (Section 34).
7. Right to damages — You are entitled to claim compensation for damages sustained due to inaccurate, incomplete, or outdated personal information.
8. Right to file a complaint with the NPC — If you believe your rights have been violated, you may file a complaint with the National Privacy Commission at www.privacy.gov.ph.

5. Data Retention

We retain personal data only for as long as necessary for the purposes described above, or as required by law:

• Payroll and financial records: 7 years (BIR statutory requirement).
• Audit logs and security records: 5 years (NPC recommendation).
• General profile and activity data: 3 years after your last activity or contract end, whichever is later.

After the applicable retention period, data is securely deleted or anonymised.

6. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit (TLS 1.2+) and at rest.
• Role-based access control (RBAC) — each user accesses only the data their role permits.
• Tenant data isolation — data belonging to one organisation cannot be accessed by another.
• Comprehensive audit logging of all sensitive data operations.
• Regular security reviews against OWASP standards.

7. Data Protection Officer

For privacy-related queries, complaints, or to exercise any of your rights, contact our Data Protection Officer:

We will respond to all verifiable requests within 15 business days, as required by the NPC.

8. How to Exercise Your Rights

If you are a registered user of Orqafy, you can exercise most rights directly from within the platform:

• Sign in to your workspace, then navigate to Settings → Privacy & My Data to view your data, export it, request corrections, request erasure, or object to processing.
• Alternatively, contact our DPO directly at the email above with your full name and workspace identifier.

We may ask you to verify your identity before processing your request.