Privacy Policy

1. Scope

The System is an internal tool for SCPA employees with a Company-issued @scpa.com.ph email address. This Policy covers personal data of employees who use the System and of customer contacts recorded in it.

2. Personal data we collect

• Account details: your first and last name, Company email address, mobile number, branch, profile picture (optional) and the roles assigned to you.
• Sign-in data: authentication records and session cookies needed to keep you signed in, including when you sign in with your Company Microsoft account.
• Activity records: requests you create, edit or delete; approvals, processing, cancellations and receiving confirmations; role requests and user management changes, each logged with your name and a timestamp.
• Uploaded files: contracts, dispenser proofs and other attachments added to requests.
• Customer contact data: names, addresses and contact details of customer representatives entered as part of master data or requests.

3. How we use it

Personal data in the System is processed only to:

• verify your identity and confirm you are an authorized SCPA employee;
• assign roles and route requests to the right approvers and points of contact;
• create, approve, process, deliver and track sample and dispenser requests;
• send in-app and email notifications about requests and your account;
• maintain audit trails for inventory control, internal audit and compliance;
• secure the System and investigate misuse or incidents.

The legal basis for this processing is the Company's legitimate interest in managing its business operations and your employment, and compliance with legal and regulatory obligations. Personal data is not used for marketing and is not sold.

4. Who can see it

• Other users see your name, profile picture and role where needed to route or act on a request, for example the approver or point of contact assigned to it.
• Branch Admins can see account and activity details for users in their branch; the System Owner can see them across all branches.
• Authorized Company personnel, such as internal audit, IT and management, may access records when their role requires it.
• Service providers that host the System, such as our database, authentication and file storage provider, process data on the Company’s behalf under contractual safeguards.
• Government authorities, when disclosure is required by law or a lawful order.

5. Storage and security

Data is stored with a cloud hosting provider and protected with encrypted connections, role-based access controls, database row-level security and access logging. Private files such as contracts and dispenser proofs are only available to authorized users. No system is completely secure, so report any suspected breach to your branch Admin right away.

6. Retention

Request, approval and audit records are kept for as long as needed for business, audit and legal purposes under the Company's records retention policy. When your access is removed, your account is deactivated rather than erased so that the history of requests you took part in stays intact. Data that is no longer needed is deleted or anonymized.

7. Cookies

The System uses only essential cookies and browser storage to keep you signed in, remember preferences such as your selected branch, and save unsent request drafts. It does not use advertising or third-party tracking cookies.

8. Your rights

Under the Data Privacy Act, you have the right to be informed, to access, to correct, to object, to erasure or blocking, to data portability, to damages and to file a complaint with the National Privacy Commission. You can update your name, mobile number and profile picture in Account Settings. For other requests, contact your branch Admin or the Company's Data Protection Officer. Some requests may be limited where records must be kept for legal or audit reasons.

9. Changes to this Policy

The Company may update this Policy from time to time. The effective date above shows when it was last changed.

10. Contact

For privacy questions or concerns, contact SCPA's Data Protection Officer through the Company's Human Resources or Legal department, or reach out to your branch Admin.