Privacy Notice – Admin & Facilities Management System (AFMS)

TCL.Online Services Incorporated ("the Company") respects your privacy and processes personal data in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). This notice explains what AFMS collects, why, and your rights.

1. What we collect

• Employees and users: name, username, work email, department, date hired, employee ID number, a security question and a protected (hashed) answer, and records of your requests, bookings, help tickets, chat messages and activity in AFMS.
• Visitors: name, company, purpose of visit, the ID type and ID number shown, vehicle plate, badge number, the person or department visited, and time in and out.
• Contractors, drivers and couriers: names of workers, drivers and parcel senders or recipients, vehicle plates, permits and gatepasses.
• Incident reports: people involved (which may include suspects, victims and witnesses), statements and evidence.
• Vendors: contact persons and business details for accreditation and procurement.

2. Why we use it, and on what basis

• To run the facilities, keep the building secure, control access, and respond to incidents – the Company's legitimate interests and legal obligations (Sections 12 and 13 of the Act).
• To manage your employment-related services: accounts, help requests, bookings, approvals and internal communication – necessary for your employment.
• To meet regulatory requirements, such as PEZA movement of goods and records required by law.

We collect only what these purposes need. We do not sell personal data or use it for marketing.

3. Who can see it

Access is limited to authorised staff whose role requires it (for example, incident reports only to Security, HR and the Head of Operations). Personal data may be shared with government agencies when required by law (e.g. PEZA, law enforcement with a lawful order), and with service providers acting on the Company's instructions under data-sharing or outsourcing agreements.

AI helper: questions you type into *Ask AI*, and the text of a new helpdesk ticket when the AI writes the first reply, are sent to Anthropic (the maker of Claude), a service provider outside the Philippines, to produce the answer. AFMS keeps only who asked, when, and how much was used - not the questions. Please don't type passwords or other people's personal details into Ask AI.

4. How long we keep it

Record	Kept for
Visitor logs	5 year(s)
Parcel logs	5 year(s)
Goods logs and gatepasses	5 year(s)
Contractor work permits	5 year(s)
Incident reports	5 year(s)
Closed helpdesk tickets	5 year(s)
Chat messages	5 year(s)
Unfinished registrations	7 days

After that, personal details are removed (anonymised) or deleted. Records may be kept longer if needed for a legal claim or investigation.

5. How we protect it

Role-based access, individual accounts, audit trails of who viewed or exported sensitive records, checked file uploads, encrypted backups, and the Company's information security policies. Personal data breaches are handled and, where required, reported to the NPC and affected persons within 72 hours.

6. Your rights

Under the Act you have the right to be informed; to access your personal data; to object to processing; to correction; to erasure or blocking; to data portability; to damages; and to file a complaint with the National Privacy Commission (privacy.gov.ph). Use My privacy to download your data or make a request; we answer within 15 business days.

7. Contact our Data Protection Officer

Fernando Castaneda II · fgcastaneda@tcl.com · 09194072553
TCL.Online Services Incorporated, 23rd Floor, Filinvest Axis Tower 2, Northgate Cyberzone, Filinvest Corporate City, Alabang, Muntinlupa City, Metro Manila