Privacy Policy

1. Who we are (Data Controller)

Data Protection Officer (DPO)

The DPO is your point of contact for privacy questions, access requests, complaints, and consent withdrawal.

2. Personal data we collect

We collect the following categories of personal data:

2.1 Identity & contact data

Full name, date of birth, gender, civil status, nationality, government-issued ID photos (for resident verification), email address, mobile and landline numbers, emergency contact details.

2.2 Property & occupancy data

Unit number, ownership records, lease/occupancy status, move-in/move-out dates, household members, pets, vehicles.

2.3 Financial & billing data

Association dues, utility charges, invoices, payment records, payment proof images, reference numbers, payment channels used.

2.4 Operational data

Visitor logs, gate passes, delivery records, work permits, maintenance and incident reports, facility bookings, announcements you interact with, chat messages within the app.

2.5 Device & technical data

Device push-notification tokens, device type and OS version, IP address, user-agent string, login timestamps, session identifiers, audit log entries.

2.6 Sensitive personal information (DPA §3(l))

Government-issued ID images and numbers are treated as sensitive personal information and processed only where strictly necessary to verify residency, ownership, or identity.

We do not knowingly collect personal data from children under 18. The Service is intended for adult unit owners, residents, staff, and authorised household representatives.

3. Why we process your data (Purposes & Legal Basis)

DPA processing requires a lawful basis under §12 (personal data) or §13 (sensitive personal data). We rely on the following:

We do not sell your personal data. We do not use your data for automated decision-making that produces legal effects on you.

4. Who we share your data with

4.1 Within your community

• Your association/property management entity (the data controller for your community's operations)
• Authorised board members and staff (security, maintenance, accounting) on a need-to-know basis
• Other residents only when you initiate contact (e.g., posting in a community channel, listing in the resident directory if enabled)

4.2 Our processors and service providers

We use the following service providers (“Personal Information Processors” under the DPA). Each is bound by a written agreement to process your data only on our instructions and to implement reasonable and appropriate security measures.

4.3 Disclosures required by law

We may disclose your data to government authorities, courts, or regulators when required by a valid subpoena, court order, or written demand under Philippine law (e.g., NBI, BIR, AMLC, NPC).

5. Cross-border transfers

Some of our processors store and process data outside the Philippines (primarily Singapore and the United States). When data is transferred internationally we ensure appropriate safeguards consistent with NPC Circular 16-02 and prevailing NPC guidance, including:

• Written data-processing agreements with binding confidentiality and security obligations
• Use of standard contractual clauses or equivalent legal mechanisms where applicable
• Verification that the processor's home jurisdiction provides adequate data-protection standards

You may request a list of the active safeguards from the DPO.

6. How long we keep your data (Retention)

We keep personal data only for as long as necessary for the purpose for which it was collected, subject to legal retention requirements.

After the retention period elapses, we either delete the data securely or anonymise it for statistical use.

7. Your rights under the Data Privacy Act

As a data subject you have the following rights:

1. Right to be informed — to be told that your data is being or has been collected and processed.
2. Right to access — to request a copy of the personal data we hold about you.
3. Right to correction — to ask us to fix inaccurate or outdated information.
4. Right to erasure or blocking — to have your data removed or its processing suspended when there is a substantial legal basis under DPA §16(e).
5. Right to object — to refuse processing for specific purposes such as direct marketing.
6. Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
7. Right to damages — to be indemnified for damages sustained from inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data.
8. Right to file a complaint — with the National Privacy Commission.

To exercise any of these rights, email dpo@collo.ph. We will respond within 30 calendar days. We may need to verify your identity before acting on a request.

8. Withdrawing consent

You can withdraw your consent at any time:

• Marketing: tap “Unsubscribe” in any marketing email, or change your notification preferences in the app.
• Service use: open the mobile app → Account → Request Account Deletion, or email dpo@collo.ph.
• Cookies: clear cookies in your browser; disable non-essential cookies via the website cookie banner.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. If you withdraw consent that is necessary to provide the Service, we may have to discontinue your access to the Service.

9. How we protect your data (Security)

We implement organisational, physical, and technical security measures appropriate to the risk of processing, including:

• Access control: role-based access, principle of least privilege, multi-factor login via one-time passcode (OTP).
• Encryption: TLS 1.2+ in transit; AES-256 at rest in our database and object storage.
• Network security: row-level security policies on every database table; API-level multi-tenant isolation; cloud firewall rules.
• Audit logging: every privileged operation is logged with user, timestamp, IP, and user-agent.
• Incident response: documented breach response plan, notification to the NPC and affected data subjects within 72 hours where required by NPC Circular 16-03.
• Vendor management: due-diligence and written agreements with all processors.
• Personnel training: annual data-privacy training for staff who handle personal data.

No system is fully secure. If you become aware of a security issue, please email dpo@collo.ph.

10. Cookies and similar technologies

Our website collo.ph uses cookies and similar technologies for:

• Strictly necessary cookies — session management, security (cannot be disabled).
• Functional cookies — remember language and display preferences.
• Analytics cookies — measure usage and improve the Service. Requires your consent.

The Collo mobile apps and the resident web portal do not use third-party advertising trackers or cross-site tracking pixels.

11. Children

The Service is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, please email dpo@collo.ph and we will delete it.

12. Filing a complaint with the NPC

If you believe your privacy rights have been violated and you are not satisfied with our response, you may file a complaint with the National Privacy Commission:

• Email: complaints@privacy.gov.ph
• Website: https://privacy.gov.ph
• Phone: +63 (2) 8234-2228
• Address: 5th Floor, Philippine International Convention Center, Vicente Sotto Avenue, Pasay City, Metro Manila

13. Changes to this Policy

We may update this Privacy Policy from time to time. The “Version” stamp at the top of this page reflects the current version. When we make material changes, we will:

• Update the Version and Effective date.
• Re-prompt you to review and accept the new policy the next time you log in to the app or website.
• Notify you via email if the changes affect your rights or our use of your data.

Continued use of the Service after the updated policy takes effect constitutes acceptance of the changes (subject to any required new consents).

14. Contact

For any questions, requests, or complaints regarding this Privacy Policy or the way we handle your personal data: