Data Privacy Policy

1. Overview, Scope & Legal Commitment

NDSOR Technologies IT Solutions ("NDSOR Tech", "we", "our", or "us"), founded and managed by Nonie John B. Sortigosa, located in Zarraga, Iloilo, Philippines, is committed to safeguarding personal, sensitive, and operational data in full accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and applicable circulars of the National Privacy Commission (NPC).

This Privacy Policy governs data collected across our corporate website (ndsor.com), our desktop software suite (NDSOR Suite, NDSOR Workforce, NDSOR Pay, GlobalinxSys ERP, NDSOR Clinic EMR, Sales & Inventory Systems), our custom web platforms (RAISE Knowledge Hub, WVSUMC Clinical Evaluation System), and our bespoke IT engineering and consultation engagements.

2. Data Roles: Controller (PIC) vs. Processor (PIP)

Under RA 10173, legal responsibilities differ depending on the capacity in which data is processed:

3. Categories of Data We Collect & Process

We process information categorized as follows:

• Website Inquiries & Consultation Records: Full name, company name, corporate email address, contact numbers, job titles, and business requirements submitted through consultation forms, demo booking modals, or email inquiries.
• Client Employee Masterlists & Compensation Data: Employee names, IDs, department designations, shift rosters, hourly/daily wages, piece-rate productivity tallies, and statutory contributions (SSS, PhilHealth, Pag-IBIG, BIR withholding tax) processed inside NDSOR Pay and NDSOR Workforce.
• Biometric Attendance Telemetry: Hardware-direct communication logs interfacing with ZKTeco biometric terminals. Biometric devices calculate mathematical algorithm templates; raw biometric fingerprint or facial imagery is not transmitted to NDSOR Tech web servers. Punch logs include employee IDs, verification timestamps, terminal serials, and state indicators processed on the client's internal network.
• Clinical, Patient & Healthcare Data: For NDSOR Clinic EMR and the WVSUMC Clinical Evaluation System, patient records, clinical encounter notes (SOAP format), physician prescriptions, surgical procedure logs, and medical residency grading rubrics are processed with strict physician-patient confidentiality under DOH and NPC clinical standards.
• Commercial, ERP & Supply Chain Data: Retail point-of-sale transactions, wholesale inventory stock movements, ice plant pre-order batch records, fuel pump shift handoffs, and vehicle fleet GPS waypoint logs processed within GlobalinxSys ERP and Sales & Inventory Systems.
• Technical Telemetry & Security Diagnostics: IP addresses, browser types, session timestamps, device architectures, and error diagnostics collected automatically to maintain website stability and firewall defense.

4. Biometric & Sensitive Personal Information Protections

Under Section 13 of Republic Act No. 10173, biometric and health data are classified as Sensitive Personal Information. NDSOR Tech adheres to stringent architectural principles:

• Template-Only Processing: Biometric verification algorithms store mathematical vector representations on physical terminal hardware, preventing the reconstruction of original fingerprint or facial photos.
• Premises-Local Retention: In standalone mode, biometric punch logs reside strictly within the client's local SQLite database behind the client's internal local area network (LAN).
• Strict Purpose Limitation: Biometric timestamps are utilized exclusively for legitimate time and attendance verification, overtime calculation, and payroll generation.

5. Lawful Basis and Purposes of Processing

We process personal and enterprise information under lawful criteria recognized by Section 12 and Section 13 of the DPA:

• Contractual Performance: Providing software licenses, activating modules, provisioning updates, conducting system migration, and delivering SLAs.
• Legal & Statutory Compliance: Enabling clients to compute mandated statutory deductions and maintain labor compliance records required by DOLE, BIR, SSS, and PhilHealth.
• Legitimate Interests: Hardening software infrastructure, preventing unauthorized license distribution, debugging crash reports, and maintaining cybersecurity.
• Consent: Communicating with prospective clients who voluntarily submit consultation inquiries.

6. Technical, Organizational & Physical Safeguards

NDSOR Tech implements multi-layered security measures to guard against accidental destruction, unlawful erasure, alteration, or unauthorized access:

7. Data Retention & Secure Disposal

Personal data is retained only for as long as necessary to fulfill the operational, commercial, or legal purposes for which it was gathered:

• Website Inquiries: Retained for up to twenty-four (24) months from submission or until business negotiations conclude.
• Client Operational Databases: Retained strictly per client policy and statutory Philippine labor/tax recordkeeping obligations (typically 3 to 10 years).
• Secure Sanitization: When retention periods expire or upon contract termination, records are purged using NIST SP 800-88 cryptographic wiping standards.

8. Your Rights under Republic Act No. 10173

As a data subject under Philippine law, you are entitled to the following statutory rights: