1. Your rights at a glance
The Data Privacy Act of 2012 gives you real, enforceable rights over your personal information. They are not favours we grant — they are yours, and exercising them is free.
| Right | What it means in practice |
|---|---|
| To be informed | To know that we hold your data, why, where it came from, who it is shared with, and how long we keep it. Our Privacy Notice covers this. |
| To access | To get a copy of the personal data we hold about you, plus the details of how it is processed. |
| To rectification | To have inaccurate or incomplete data corrected or completed. |
| To erasure or blocking | To have data removed or its processing suspended where it is incomplete, outdated, false, unlawfully obtained, or no longer necessary. |
| To object | To refuse processing, including direct marketing and automated profiling, or to withdraw consent you previously gave. |
| To data portability | To receive the data you gave us in a structured, commonly used, machine-readable format where processing is by electronic means and based on consent or contract. |
| To damages | To be indemnified for damage sustained because of inaccurate, incomplete, outdated, false or unlawfully obtained use of your personal data. |
| To complain | To bring a complaint to the National Privacy Commission at any time. |
If you are in the EEA or the UK, equivalent rights under the GDPR apply where that law covers the processing. Where we act as a processor for a client, we will route your request to that client as the controller.
2. How to make a request
Send your request through the contact form, choosing “Data privacy request”, or write to the Data Protection Officer at 39th Street corner 11th Avenue, Bonifacio Global City, Taguig City 1634, Metro Manila, Philippines.
To help us act quickly, please include:
- Your full name, and any other name we may hold you under (for example the name on a CV or an enrolment form).
- The email address or phone number you used when dealing with us.
- Which right you are exercising, and what outcome you want.
- Enough context to find the records — for example "I applied for a bilingual role in March" or "I enrolled in Japanese N5 last year".
- How you would like to receive our response.
You may use this wording:
"I am exercising my right to [access / correction / erasure / object / portability] under the Data Privacy Act of 2012 in relation to the personal data Alaya Business Process Outsourcing holds about me. My details are: [name], [email], [context]. Please confirm receipt and respond within 15 calendar days."
3. Verifying who you are
Before we release or change personal data we have to be sure the request is genuinely yours — otherwise the right becomes a security hole. We will usually verify by replying to the email address already on record, or by asking for details only you would know.
If stronger verification is needed we may ask for a copy of a government-issued identification document. If we do, please redact everything except your name, photograph and the document type. We use it only to verify you and delete it immediately afterwards.
4. How long we take
- Acknowledgement: within 2 business days.
- Substantive response: within 15 calendar days of receiving a complete, verified request.
- Complex requests: if a request is genuinely complex or covers a large volume of records, we will tell you within the 15 days why more time is needed and when you can expect the response.
There is no charge. For repetitive or manifestly excessive requests we may charge a reasonable administrative fee or decline, and we will explain why in writing.
5. When we may not be able to say yes
Some rights have limits. We may be unable to delete data that we are legally required to keep (tax and employment records, for example), data needed to establish or defend a legal claim, or data whose removal would prejudice an ongoing investigation. Access may be limited where releasing a record would disclose another person's personal data.
Where we refuse or restrict a request, we will tell you which exemption applies, what we have done instead, and how to challenge the decision.
6. If your data is with us because of one of our clients
When we handle customer data for a client — a support ticket you raised with a company we serve, for instance — that company is the controller and decides the outcome of your request. We will forward your request to them promptly, tell you that we have done so, and assist them in responding.
If you know which company you dealt with, contacting them directly will usually be faster.
7. If you are not satisfied
Reply to our response and say why. The Data Protection Officer will review it personally.
You may also complain at any time to:
National Privacy Commission
5th Floor, Delegation Building, PICC Complex, Vicente Sotto Street, Pasay City 1307,
Metro Manila, Philippines
privacy.gov.ph ·
info@privacy.gov.ph
Check the NPC website for its current complaint procedure and contact details.
8. Reporting a suspected breach
If you believe personal data held by us has been exposed, misused or lost, tell us immediately through the contact form, choosing “Data privacy request” and starting your message with “Suspected data breach”. We treat these reports as urgent, investigate on the day, and where a breach is notifiable we inform the National Privacy Commission and the affected individuals within 72 hours of knowledge of it.