1. Who we are
This Privacy Notice explains how Alaya Business Process Outsourcing ("Alaya", "we", "us") collects, uses, discloses, stores and protects personal information. Alaya is a business name registered with the Philippine Department of Trade and Industry, with its office at 39th Street corner 11th Avenue, Bonifacio Global City, Taguig City 1634, Metro Manila, Philippines.
We are committed to processing personal data fairly and lawfully under Republic Act No. 10173, the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).
- Data Protection Officer
- Reachable through the contact form — choose “Data privacy request”
- Postal address for privacy matters
- Data Protection Officer, Alaya Business Process Outsourcing, 39th Street corner 11th Avenue, Bonifacio Global City, Taguig City 1634, Metro Manila, Philippines
2. Who this notice covers
This notice applies to:
- Website visitors — anyone browsing alaya.biz or contacting us through it.
- Client contacts — representatives of companies that engage, or consider engaging, our services.
- Learners — students enrolled in our language courses, and the corporate sponsors who enrol them.
- Job applicants — see section 11.
- Suppliers and partners — individuals we deal with at vendor organisations.
It does not describe how we handle personal data belonging to our clients' customers, which we process on our clients' instructions as a personal information processor — see section 5. Our employees receive a separate internal employee privacy notice.
3. What we collect
Information you give us
- Identity and contact details: name, company, job title, email address, telephone number, country.
- Enquiry content: what you write in a form, an email or a message, including the volumes, languages and requirements you describe.
- Enrolment details for language courses: level, placement assessment results, attendance, assessment scores and certificates issued.
- Billing details for clients and learners: billing contact, address, tax identification, bank or payment reference. We do not store full payment card numbers.
- Application materials, if you apply for a role — see section 11.
Information collected automatically
- Server log data when you visit this website: IP address, date and time, pages requested, referring page, browser and operating system. This is generated by the hosting infrastructure and is used for security and troubleshooting.
- Font delivery: this site loads typefaces from Google Fonts, which receives your IP address and request headers as a technical necessity of serving the files. See our Cookie Policy for how to avoid this.
Sensitive personal information
Under the Data Privacy Act, information about health, education, race, ethnic origin, marital status, age, religion, political affiliation, government-issued identifiers and records of offences is sensitive personal information. We collect it only where it is genuinely necessary — for example statutory identifiers required for employment, or accessibility needs you tell us about — and we protect it with stricter controls.
4. How and why we use personal data
We process personal data only where at least one lawful criterion under the Data Privacy Act applies. In practice:
| Why we process it | Lawful criterion |
|---|---|
| Responding to your enquiry and preparing a proposal | Consent, and steps taken at your request prior to entering a contract |
| Delivering services under a signed agreement, invoicing and account management | Performance of a contract |
| Enrolling, teaching, assessing and certifying language learners | Performance of a contract |
| Keeping accounting, tax and corporate records | Compliance with a legal obligation |
| Securing our systems, preventing fraud and investigating incidents | Legitimate interests, and legal obligation where a breach is notifiable |
| Sending service updates, or occasional information about courses and services | Consent, which you may withdraw at any time |
| Assessing a job application | Consent, and steps prior to entering an employment contract |
Where we rely on legitimate interests, we balance those interests against your rights and do not proceed where your interests override ours. You can ask us for the details of that assessment.
We do not sell personal data, rent mailing lists, or use the contents of client or learner data to train third-party artificial intelligence models.
5. When we act for our clients
In our outsourcing work, our clients' customers' personal data is processed by us as a personal information processor (a "processor" under the GDPR). The client remains the controller and decides the purposes and means of processing.
- We process that data only on the client's documented instructions.
- Every engagement is covered by a written outsourcing or data processing agreement meeting the requirements of the Data Privacy Act IRR and, where relevant, Article 28 of the GDPR.
- Our personnel are bound by confidentiality obligations that survive the end of employment.
- We assist the client with data subject requests, breach notification, and security reviews or audits.
- On termination, we return or securely delete the data at the client's election, except where retention is legally required.
If you are a customer of one of our clients and want to exercise your rights over your data, contact that company directly; if you contact us, we will forward your request to them and tell you we have done so.
6. Who we share data with
We disclose personal data only in these circumstances:
- Service providers who support our operations — hosting, email, helpdesk and collaboration tools, payroll and accounting providers — under contracts that restrict their use of the data to our instructions.
- Clients, where you are a learner enrolled and paid for by your employer (attendance and assessment results only), or where a client participates in interviewing staff for their programme.
- Professional advisers — lawyers, auditors and insurers — under duties of confidentiality.
- Government authorities, where disclosure is required by Philippine law, a court order, or a lawful request from a regulator such as the NPC or the Bureau of Internal Revenue.
- A successor entity, if the business is reorganised, sold or merged — subject to the same protections described here.
7. International transfers
We are based in the Philippines. If you are outside the Philippines, your personal data is transferred here when you contact us or contract with us. Some of our service providers store data in other countries.
Where personal data originating in the European Economic Area or the United Kingdom is transferred to us, we rely on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Addendum) together with supplementary technical and organisational measures. Under the Data Privacy Act we remain accountable for personal data we transfer onward, and we contractually require a comparable level of protection from any recipient.
8. How long we keep it
| Record | Retention |
|---|---|
| Website enquiries that do not become a relationship | Up to 24 months from last contact |
| Client contracts and related correspondence | For the term, then 10 years (statutory and limitation periods) |
| Accounting, invoicing and tax records | 10 years, as required by Philippine tax regulations |
| Learner enrolment, assessment and certificate records | 5 years after the last course completed |
| Unsuccessful job applications | 12 months, unless you ask us to delete sooner |
| Server and security logs | Up to 12 months |
| Client customer data processed on a client's behalf | As instructed by that client in the data processing agreement |
When a retention period ends, records are securely deleted or anonymised. Backups are overwritten on their own cycle, and data in a backup is not restored into active use.
9. How we protect it
We maintain organisational, physical and technical security measures proportionate to the risk, including:
- Role-based access on a least-privilege basis, unique named accounts and multi-factor authentication on administrative systems.
- Encryption of data in transit, and of data at rest on company devices.
- Clean-desk, no-phone and no-removable-media rules on programmes that handle sensitive data, in a restricted and access-controlled area.
- Confidentiality undertakings and mandatory privacy and security training for every employee, at onboarding and annually.
- Logging and monitoring of access to systems containing personal data.
- A documented incident response procedure. Where a personal data breach is likely to give rise to a real risk of serious harm, we notify the National Privacy Commission and the affected data subjects within 72 hours of knowledge of the breach, as required by law, and we notify our clients without undue delay.
No system is perfectly secure. We do not claim otherwise — we claim that we take reasonable and appropriate measures, test them, and tell you honestly if something goes wrong.
10. Your rights
Under the Data Privacy Act you have the rights to be informed, to object, to access, to rectification, to erasure or blocking, to damages, and to data portability, as well as the right to lodge a complaint with the National Privacy Commission.
Our dedicated page explains each right in plain language and gives you a step-by-step way to use it: Your data rights.
To exercise a right, use the contact form and choose “Data privacy request”. We respond within 15 calendar days where practicable, and tell you in advance if a request is complex enough to need longer.
11. Job applicants
When you apply for a role at Alaya, we collect your CV and the information in it, your contact details, your assessment results and interview notes, your stated language proficiencies, and references where you provide them. We use this only to assess your application and to communicate with you about it.
- We keep unsuccessful applications for 12 months in case a suitable role opens, then delete them. You can ask us to delete yours at any time through the contact form.
- Pre-employment requirements such as government identifiers, NBI clearance and medical examination results are collected only after a conditional offer, and are retained as required by labour and tax law.
- We do not charge applicants any fee at any stage, and we will never ask you for payment, your bank card, your e-wallet PIN or a one-time password.
- Shortlisted candidates for a client-specific programme may be introduced to that client with your knowledge.
12. Language training learners
For learners we hold enrolment details, placement and assessment results, attendance, and certificates issued. Where a company pays for your course, we report your attendance and assessment outcomes to that company as the sponsor — we tell you at enrolment exactly what will be shared.
Class recordings may be made so learners on shifting schedules can catch up. You are told before a session is recorded, recordings are shared only with the class and the instructor, and they are deleted at the end of the course cycle unless you agree otherwise.
13. Children
Our services are directed at businesses and at adults. We do not knowingly collect personal data from children under 18 without the consent of a parent or guardian. Minors may enrol in language courses only with a parent or guardian's written consent, and the parent or guardian exercises the data subject rights on the minor's behalf. If you believe a child has given us personal data without that consent, tell us through the contact form and we will delete it.
14. Complaints
If you are unhappy with how we have handled your personal data, tell our Data Protection Officer through the contact form. We will acknowledge within 2 business days and investigate.
You also have the right to complain directly to the regulator:
National Privacy Commission (Philippines)
5th Floor, Delegation Building, PICC Complex, Vicente Sotto Street, Pasay City 1307,
Metro Manila
privacy.gov.ph ·
info@privacy.gov.ph
Please check the NPC website for current contact details and complaint procedures.
If you are in the EEA or the UK, you may also complain to your local supervisory authority.
15. Changes to this notice
We review this notice at least annually and whenever our processing changes materially. The "last updated" date at the top of this page always reflects the current version. Where a change materially affects how we use data you have already given us, we will tell you directly before it takes effect.