iFIVE Inc. Privacy Statement
At iFIVE, Inc. (the “Company”), with its registered address at 8th Floor, Robinsons Zeta Tower, C‑5 Road, Ugong Norte, Quezon City, Metro Manila 1110, Philippines, the protection of personal data is a fundamental part of delivering trusted, high-quality services. This commitment extends to all individuals with whom the Company engages, including clients, employees, job applicants, contractors, partners, and other stakeholders.
This Privacy Policy is aligned with internationally recognized data protection standards, including the principles set out in the General Data Protection Regulation (GDPR). It also reflects compliance with applicable local data protection laws, including the Republic Act No. 10173 (Philippine Data Privacy Act of 2012), together with its implementing rules and regulations and relevant issuances.
For purposes of this Policy, these laws and any other applicable data privacy or data protection laws in the jurisdictions where the Company operates or provides services shall collectively be referred to as “Data Protection Law.”
The Company processes personal data in accordance with such Data Protection Law, which governs the collection, use, processing, storage, and protection of personal data across its operations.
Scope of this Privacy Statement
This policy covers all Personal and Sensitive Information gathered in the course of your transactions with the Company.
1. What Personal Data We Collect
a. Business and Professional Information
Information such as name, company or business name, business address, role or position, and other details relevant to client, vendor, or partner engagements.
b. Technical Data
Information collected through systems and digital platforms, including IP address, browser type and version, time zone setting, browser plug-in types, geolocation data, operating system, and device-related information.
c. Website and System Usage Data
Information on how individuals interact with Company websites and systems, including URL clickstreams, pages viewed, services accessed, page response times, download errors, duration of visits, and other usage patterns.
d. Employment and Recruitment Data
For employees and job applicants, information may include name, contact details, email address, signature, date of birth, government-issued identification numbers, employee number, salary and compensation details, nationality, job title, employment history, employment agreement and contract, educational background, leave records, training records, performance, disciplinary records, and other information relevant to recruitment and employment.
e. Sensitive Personal Information
Where necessary and permitted by applicable law, the Company may process sensitive personal information (as defined under the Republic Act No. 10173 and other applicable data protection laws). This may include government-issued identifiers, financial information, and health-related data such as medical records or health history, particularly where relevant for employment, benefits administration, workplace safety, or legal compliance. Such information is collected and processed only with appropriate safeguards and, where required, a valid legal basis or consent.
f. Voluntarily Provided Information
Any information provided directly by individuals through forms, surveys, inquiries, or other interactions with the Company.
All data collected is limited to what is relevant and necessary for its intended purpose and is handled in accordance with applicable data protection laws and Company policies.
2. Why We Collect Your Data
- To provide, maintain, and improve our services.
- To respond to inquiries and provide customer support.
- To process applications and support recruitment.
- For employment-related purposes such as onboarding, payroll, benefits administration, performance management, and other HR-related processes
- To communicate updates and relevant information.
- To comply with legal and regulatory requirements.
- To maintain accurate records for employment, business, or contractual purposes.
3. How We Collect and Hold Your Data
iFIVE Inc. collects personal information directly from a data subject whenever practicable and reasonable to do so. When we collect personal information directly from you, this may occur through the following means:
- Directly from individuals when they interact with us through applications, forms, contracts, or inquiries, and through social media engagement
- Through communications such as email, chat, telephone, meetings, and other business interactions
- When individuals use our websites, systems, or company-managed platforms and tools
- When completing a job application, contract, agreement, or other related documents
- Through recruitment channels such as job portals, referrals, interviews, and background verification processes specifically for job applicants
- From clients, where personal data is shared with the Company for the purpose of delivering outsourced services
- From trusted third parties such as service providers, verification agencies, educational institutions, and government or regulatory bodies, where permitted by law
All personal information collected is processed only for declared, specified, and legitimate purposes, and in a manner that is adequate, relevant, suitable, necessary, and not excessive in relation to such purposes.
Personal Information Obtained from Clients and Other Third Parties
Some personal information processed by the Company is not collected directly from the data subject. This may occur when the Company provides digital customer experience solutions, managed outsourcing services, and customer contact centre services to its clients across various industries and jurisdictions. In such cases, the Company processes personal information on behalf of its clients and acts as a Personal Information Processor (PIP), while the clients serve as the Personal Information Controller (PIC) in accordance with applicable data protection laws.
Where applicable, the Company complies with the Republic Act No. 10173, while also supporting compliance with relevant international data protection laws, such as the General Data Protection Regulation and relevant U.S. data privacy laws (e.g., HIPAA, CPRA, etc.), based on client requirements and the jurisdictions involved.
In such cases, personal information is provided to the Company by its clients because:
The client has already collected the information directly from the data subject or another lawful source; and
It is impracticable or unnecessary for the Company to collect information directly from the data subject.
For example, when the Company sends email, chat, or other customer communications on behalf of a client, the Company may process contact details and related information supplied by that client strictly for the performance of the contracted services.
For personal information provided by clients, iFIVE Inc. requires contractual assurances that:
- The personal information was collected lawfully and in compliance with applicable data protection laws and regulations in the client’s jurisdiction;
- Appropriate privacy notices were provided and lawful criteria for processing (such as consent, contractual necessity, or legitimate interest) were satisfied; and
- Personal information may be disclosed to and processed by iFIVE Inc. for agreed purposes.
The processing of such personal information shall also be governed by the client’s privacy policies and data protection requirements, which apply in addition to this Privacy Policy. Data subjects are encouraged to review the relevant client’s privacy notice or contact the client’s data protection officer for more information.
Collection from Other Third Parties
iFIVE Inc. may collect personal information from third parties other than our clients, where permitted by law, including:
- Recruitment platforms, job portals, or third‑party placement vendors;
- Referees or character references;
- Publicly available sources;
- Educational institutions, professional or industry associations;
- Credit reporting agencies (where applicable);
- Law enforcement agencies or regulatory and government authorities, pursuant to lawful requests.
Employment and Engagement‑Related Information (Philippines)
If you apply for employment, consultancy, or engagement with iFIVE Inc. in the Philippines, we may collect personal information through:
- Information you submit via our recruitment portals, application forms, or resumes;
- Interviews, consultations, assessments, or onboarding processes;
- Referrals, former employers or work colleagues;
- Educational institutions, professional or industry associations;
- Registration, licensing, or regulatory bodies; and
- Appropriate government agencies, as permitted by law.
With your consent, or where otherwise allowed under RA 10173, NPC rules, and other data protection laws, the Company may also engage third‑party service providers to:
Verify your identity, educational background, and employment history; and
Conduct background investigations, including administrative or criminal record checks, where relevant to the role.
Website Usage, Cookies, and Technical Data
iFIVE Inc. collects limited personal and non‑personal information about users of its websites for security, diagnostic, analytics, and service improvement purposes, in accordance with the principles of transparency and proportionality.
This information may include:
- The general location from which you access our website and the pages you visit; and
- Technical data such as IP address, device type, operating system, browser type, and language settings.
Such information is collected through cookies and similar technologies and is not used to directly identify individual users, unless required for security or lawful purposes.
Cookies are small text files placed on your device by a website. We may use:
- Persistent cookies, which remain on your device after you close your browser, to enhance user experience and website performance; and
- Session cookies, which are deleted once your browsing session ends, to manage website functionality and navigation.
You may configure your browser to refuse or delete cookies. However, disabling cookies may affect the availability or functionality of certain website features.
4. Legal Basis
iFIVE Inc. processes personal information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission. In addition, the Company adheres to relevant international data protection laws and standards in the jurisdictions where it operates or delivers services, as may be required by law or contractual obligations.
The Company processes personal information only when there is a lawful basis for doing so. Depending on the circumstances and purpose of processing, this legal basis may include one or more of the following:
Consent of the Data Subject
The Company processes personal information with your freely given, specific, informed, and recorded consent. Consent may be obtained through written, electronic, or other appropriate means and may be withdrawn at any time, subject to legal or contractual restrictions.
Contractual Necessity
The Company processes personal information when it is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. Examples include recruitment, employment, onboarding, service delivery, payroll, client servicing, and vendor engagement.
Compliance with a Legal Obligation
The Company processes personal information when necessary to comply with applicable laws, regulations, or lawful orders issued by courts, regulators, government agencies, or law enforcement authorities.
Legitimate Interests
The Company processes personal information where it is necessary for the legitimate interests of the Company or a third party, provided such interests are not overridden by your fundamental rights and freedoms.
This may include purposes such as operational efficiency, fraud prevention, quality assurance, security, internal audits, and service improvement.
Processing on Behalf of Clients
When iFIVE Inc. acts as a Personal Information Processor, we process personal information solely in accordance with our client’s documented instructions and the applicable data processing agreement. The legal basis for such processing is determined by the client acting as the Personal Information Controller
5. GDPR Compliance
Where applicable, iFIVE Inc. complies with the General Data Protection Regulation (EU) 2016/679 (GDPR) in relation to the processing of personal data of individuals located in the European Economic Area (EEA), the United Kingdom, and Switzerland.
Data subjects may exercise their rights under the GDPR—such as the rights of access, rectification, erasure, restriction, objection, and data portability—subject to applicable legal limitations. Where required, iFIVE Inc. ensures appropriate safeguards are in place for international data transfers.
6. Data Retention
iFIVE Inc. will retain your Personal Data only for as long as necessary to achieve the purposes described in this Privacy Policy. We may store and use your information as required to comply with legal obligations, resolve disputes, and enforce our contractual agreements and policies.
HR Records:
Employee records related to human resources (such as 201 files and employment documents) are kept for 3 to 10 years after an employee leaves the company, depending on legal and compliance requirements.
- Finance Records:
Personal information used for finance, accounting, audit, and tax purposes—some of which may also include HR-related details—are kept for as long as the company is operating and in line with regulatory requirements. - Candidate / Applicant Records:
Personal information collected during the recruitment and application process is retained for up to three (3) years from the date of application, unless otherwise required by law or with the candidate’s consent for a longer period.
Client Records:
Client data is processed and centrally managed within the Company’s subscribed systems, including Zoho CRM and PandaDoc. These platforms operate under their respective internal data privacy and security policies and are engaged in accordance with applicable data protection requirements. For more information on how these service providers process personal data, data subjects may refer to the respective privacy policies available on their official websites. In some cases, information may be stored up to 3–10 years after contract ends or until business closure, depending on the department and applicable laws. After the retention period, records are securely disposed of or anonymized.
7. Disclosure of Personal Data
iFIVE Inc. discloses personal information solely for legitimate and specified purposes and in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, pertinent issuances of the National Privacy Commission (NPC), and other applicable data protection and privacy laws
Personal information may be disclosed to the following recipients, on a need‑to‑know basis and subject to appropriate safeguards:
- Clients – where iFIVE Inc. acts as a Personal Information Processor, strictly in accordance with client instructions and contractual obligations;
- Service providers and business partners – such as IT, cloud, payroll, recruitment, background check, legal, audit, and professional service providers;
- Government authorities or regulators – where required or permitted by law or lawful order.
The Company does not sell personal information and does not disclose personal information to unauthorized parties.
Data Sharing Agreement (DSA)
Where personal information is disclosed or shared with third parties, iFIVE Inc. ensures that an appropriate Data Sharing Agreement (DSA) or equivalent contractual safeguard is executed, as required under the Data Privacy Act of 2012 (Republic Act No. 10173), relevant issuances of the National Privacy Commission (NPC), and other applicable data protection laws.
Such agreements define, among others:
- The purpose and scope of data sharing;
- The roles and responsibilities of the parties as Personal Information Controller and/or Processor;
- Data retention, security, and disposal requirements; and
- Procedures for data breach management and data subject rights.
Protection of Information
- We employ strong technical, administrative, and physical safeguards to protect sensitive data against unauthorized access, disclosure, alteration, or misuse including:
- Access and controls authentication and role-based permission
- Encryption and secure servers
- Regular security audits
- Employee training on data policy
Confidentiality
All iFIVE Inc. employees are trained and required to uphold strict confidentiality standards, particularly when handling medical records and personal employee information.
Transfer of Data
iFIVE Inc. will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.
8. Your Privacy Choices and Rights
Pursuant to the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and other applicable data privacy laws, data subjects whose personal information is processed by the Company are entitled to the following rights, subject to applicable legal limitations:
A. Right to Be Informed
You have the right to be informed whether personal information pertaining to you is being processed, including:
- The purpose of processing;
- The categories of personal information involved;
- The recipients or classes of recipients of the data; and
- The data retention period.
B. Right to Access
You may request access to your personal information held by iFIVE Inc., including information on how and why it is being processed, subject to identity verification and applicable legal exceptions.
C. Right to Object
You have the right to object to the processing of your personal information, including processing direct marketing or processing based on legitimate interest, unless the processing is required by law or is necessary for contractual performance.
D. Right to Rectification
You have the right to dispute and request correction of inaccurate, incomplete, or outdated personal information.
E. Right to Erasure or Blocking
You may request the suspension, withdrawal, blocking, or deletion of your personal information where:
- The data is incomplete, outdated, false, or unlawfully obtained;
- The data is no longer necessary for the stated purpose; or
- Consent has been withdrawn, and no other lawful basis applies.
F. Right to Data Portability
Where technically feasible, you have the right to obtain a copy of your data in a structured, commonly used, and machine‑readable format, or to have it transmitted to another entity.
G. Right to Damages
You have the right to be compensated for damages sustained due to inaccurate, incomplete, outdated, false, or unlawfully obtained personal information, or for violations of your data protection rights.
H. Right to Lodge a Complaint
You may lodge a complaint with the Data Protection Officer of iFIVE Inc. or with the National Privacy Commission if you believe your data privacy rights have been violated.
9. Access and Correction of Personal Information
Data subjects may request access to, and correction of their personal information held by iFIVE Inc., in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, other applicable data privacy laws, and National Privacy Commission (NPC) guidelines.
Upon a valid written or electronic request, the Company will provide reasonable access to:
- The personal information being processed;
- The purpose or purposes for which the information is processed;
- The categories of personal information involved; and
- The recipients or categories of recipients to whom the data has been disclosed, where applicable.
Correction and Updating of Personal Information
You have the right to request the correction, rectification, or updating of personal information that is inaccurate, incomplete, outdated, or misleading.
Upon receipt of a valid request, the Company will:
- Review the request within a reasonable period;
- Correct or update the information where appropriate; or
- Inform you if the request cannot be acted upon due to legal, contractual, or regulatory reasons.
Where iFIVE Inc. acts as a Personal Information Processor on behalf of a client, requests for access or correction may be endorsed to the relevant client acting as the Personal Information Controller, and iFIVE Inc. will reasonably assist in facilitating such requests.
10. Data Breach Complaints and Reporting
If you believe your personal information has been compromised, misused, or unlawfully accessed, you may report the incident to the Data Protection Officer (DPO) of iFIVE, Inc. through the details below
Data Protection Officer
IFIVE Inc.
Address: 8F Zeta Tower Robinsons Bridgetown C5 Road Ugong Norte Quezon City
Email: privacy@ifiveglobal.com.
The DPO will acknowledge and contact the concerned data subject within ten (10) business days from receipt of the complaint.
iFIVE, Inc. will promptly:
- Investigate and contain the incident;
- Mitigate any potential harm;
- Notify affected data subjects and the National Privacy Commission (NPC), where required; and
- Coordinate with clients where iFIVE, Inc. acts as a Personal Information Processor (PIP).
Data subjects may also lodge complaints directly with the National Privacy Commission.
11. Effective Date
The effective date of this policy is August 1, 2026.
12. References
National Privacy Commission:
Privacy.gov.ph/DPO17GDPR