At a glance: We collect only the data needed to provide, secure, support, and improve WorkVia Digital. We do not sell personal data. Access is limited according to authorized roles, and privacy requests are handled in line with applicable Philippine data-protection law.
1. Scope and our privacy roles
This Privacy Policy applies to the WorkVia Digital website, platform, applications, support interactions, and related services that link to this notice.
For website inquiries, account administration, billing, security, and our own business operations, WorkVia Digital acts as a personal information controller. When an employer, business, cooperative, clinic, hotel, retailer, or other customer uses WorkVia to manage information about its personnel, members, clients, patients, guests, suppliers, or other individuals, that customer generally determines why and how the data is processed. In that setting, the customer is the personal information controller and WorkVia generally processes the data as its authorized service provider.
If your data was entered by a WorkVia customer, contact that organization first. We will support the customer in responding to valid requests as required by applicable law and our agreement with the customer.
2. Personal data we collect
The data we process depends on the modules and features used. It may include:
- Identity and contact data, such as name, username, business email, telephone number, organization, role, and account identifiers.
- Customer-provided operational data, such as employment, attendance, payroll, benefits, accounting, sales, booking, inventory, customer, supplier, and service records entered into enabled modules.
- Financial and transaction data, such as subscription, invoice, payment-status, and business transaction records. Payment-card details may be handled directly by an authorized payment provider rather than stored by WorkVia.
- Support and communication data, including inquiries, feedback, attachments, call or meeting details, and troubleshooting records.
- Device, usage, and security data, including IP address, browser and device information, timestamps, pages or functions used, diagnostic events, audit logs, and suspected-security indicators.
- AI feature content, where enabled, such as prompts, uploaded documents, retrieved business context, and generated responses needed to provide the requested feature.
Some modules may contain sensitive personal information or privileged information. Customers should enable only the modules they need, limit collection to a legitimate purpose, and grant access only to authorized users.
3. How we use personal data
- Provide, configure, maintain, and support the platform and subscribed modules.
- Authenticate users, manage permissions, maintain audit trails, prevent misuse, and protect accounts and systems.
- Process subscriptions, transactions, service requests, and customer communications.
- Diagnose problems, measure performance, improve reliability and usability, and develop requested capabilities.
- Send service notices, security alerts, administrative messages, and—with the appropriate choice or consent—product communications.
- Comply with legal obligations, enforce agreements, establish or defend legal claims, and respond to lawful requests.
We will not use customer-controlled data for a materially different purpose unless authorized by the customer and permitted by law. Decisions with legal or similarly significant effects should not be based solely on an automated output without the safeguards required by applicable law.
4. Lawful bases for processing
Depending on the context, we process personal data because it is necessary to perform a contract or take requested steps before entering one; to comply with law; to protect vital interests; with valid consent; or for a legitimate business purpose that does not override a person’s fundamental rights and freedoms. Additional conditions apply when sensitive personal information or privileged information is involved.
Where consent is the basis, you may withdraw it for future processing. Withdrawal does not affect processing already lawfully completed and may limit a feature that requires the data.
6. Data locations and transfers
Data may be processed in the Philippines and in other locations where WorkVia or approved service providers operate. When personal data is transferred or made accessible across borders, we use contractual, organizational, and technical safeguards appropriate to the data, the service, and applicable legal requirements.
7. How long we retain data
We keep personal data only for as long as needed for the purposes described in this notice, customer instructions, our agreements, legitimate business and security needs, and applicable legal, accounting, or reporting requirements. Retention periods vary by record type, module, and customer configuration.
When retention is no longer justified, data is securely deleted, anonymized, or isolated from further use. Backup copies may remain for a limited recovery cycle before deletion or overwrite.
8. How we protect data
We apply reasonable and appropriate organizational, physical, and technical safeguards based on the nature of the data and the risks involved. Measures may include role-based access, authentication controls, encryption in transit, logging and monitoring, backups, secure development practices, vulnerability management, personnel controls, and incident-response procedures.
No online service can promise absolute security. Customers and users also help protect data by keeping credentials confidential, using appropriate access permissions, reviewing audit activity, and promptly reporting suspected compromise.
9. Your privacy rights
Subject to the Data Privacy Act of 2012, its Implementing Rules and Regulations, and other applicable requirements, you may have rights to:
- be informed about the processing of your personal data;
- access personal data and obtain information about how it is processed;
- object to certain processing or withdraw consent where consent applies;
- correct inaccurate or incomplete data;
- request erasure or blocking when the legal conditions are met;
- obtain data portability where applicable;
- claim damages when legally justified; and
- file a complaint with the National Privacy Commission.
We may verify your identity and authority before acting on a request. Some rights are subject to lawful exceptions, including the rights and freedoms of others, legal retention duties, and the establishment or defense of legal claims.
11. Children’s data
WorkVia’s website and business platform are not directed to children. A customer may process a dependent’s, student’s, patient’s, or other minor’s data in an appropriate business workflow only when the customer has a lawful basis and provides the required notices and safeguards. If you believe a child’s data was provided improperly, contact the responsible customer organization or WorkVia promptly.
12. Changes to this policy
We may update this policy to reflect changes in our services, practices, or legal obligations. We will post the revised notice here and change the effective date. If a change materially affects how we handle existing personal data, we will provide additional notice when appropriate.
13. Contact and privacy requests
For data held in a customer-controlled WorkVia workspace, contact that organization’s administrator or privacy contact first. The customer can identify the record and instruct us where necessary.
WorkVia Digital privacy inquiries
Use the official contact channel provided in your WorkVia account, service agreement, invoice, or support correspondence. You may also begin through the Contact section of our website. Please write “Privacy Request” in your message and describe the account or organization involved without sending passwords or unnecessary sensitive information.