Privacy Policy

1. About this policy

This Privacy Policy explains how ARA Industries IT Solutions OPC ("ARA Industries", "we", "us") collects, uses, shares and protects personal information when you visit ara.ph, fill in one of our forms, download a resource, book a call, or deal with us as a prospective or current business client.

We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the circulars and advisories of the National Privacy Commission (NPC). Where the EU General Data Protection Regulation (GDPR) applies to you, for example if you are in the European Union and use our site or services, we also follow the GDPR. Where the two laws differ, we apply the stricter rule.

This policy covers our website and our business contacts. When we process personal data for a client as part of a service (for example endpoint protection or managed detection and response), we act as the client's personal information processor under a separate written agreement, and the client's own privacy notice applies to those people.

2. Who we are

ARA Industries IT Solutions OPC
Unit No. 5401, Corporate Finance Plaza, Ruby and Topaz Road, Ortigas, Pasig, Metro Manila 1604, Philippines
Email: hello@ara.ph

Under RA 10173 we are the personal information controller. Under the GDPR we are the controller. We are based in the Philippines and do not have an establishment in the European Union.

Privacy questions and requests

Send privacy questions and requests to hello@ara.ph with the subject "Privacy request", or write to the address above, marked "Attention: Data Protection Officer". To report a security incident or a suspected personal data breach involving ARA Industries, email securenow@ara.ph.

3. What we collect

We collect only what we need for the purposes in section 4.

We collect most of this directly from you. Some comes automatically from your browser. We do not buy personal data.

Please don't send us sensitive personal information (for example health information, government ID numbers, or information about children) through our forms or the message box. We don't need it for an enquiry. If you send it anyway, we will delete it or limit how we use it.

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

4. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have weighed them against your rights and kept the processing limited and expected. You can ask us for details.

Where we rely on consent, you can withdraw it at any time (see section 8). Withdrawing does not affect processing we did before you withdrew.

We do not sell, trade or rent your personal information.

5. Who we share it with

We share personal information only with service providers who process it for us under written terms, and only as much as they need:

We may also disclose personal information when the law requires it, to protect our rights or the safety of others, or to professional advisers (lawyers, auditors) bound by confidentiality. If ARA Industries is reorganised, merged or sold, the information may pass to the new owner under the same protections.

We may share aggregated statistics that cannot identify you.

6. International transfers

Some of our providers process data outside the Philippines, mainly in the United States.

• Under RA 10173, we remain responsible for your information wherever it is processed (accountability principle, Sec. 21). We use contracts and other reasonable means to make sure our providers give it a comparable level of protection.
• Under the GDPR (Chapter V), where EU personal data is transferred to a country without an EU adequacy decision, we rely on the provider's certification under the EU–U.S. Data Privacy Framework where it applies, or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed.

You can ask us for more information about these safeguards.

7. How long we keep it

We keep personal information only for as long as we need it for the purpose we collected it for, or as long as the law requires.

When information is no longer needed, we delete it securely or anonymise it.

8. Your rights

Under RA 10173 (Sec. 16 to 18) and, where it applies, the GDPR (Arts. 15 to 22), you have the right to:

• Be informed about whether and how we process your personal information (this policy).
• Access your personal information and get a copy.
• Correct inaccurate or incomplete information.
• Erase or block information that is no longer needed, was unlawfully obtained, or that you withdraw consent for.
• Restrict how we use it while a concern is checked.
• Data portability: receive the information you gave us in a common electronic format, or have it sent to another organisation where feasible.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, for example with the unsubscribe link in any email or through cookie settings.
• Not be subject to solely automated decisions with legal or similar effects. We don't make such decisions.
• Be indemnified for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of personal information (RA 10173 Sec. 16(f)).
• Lodge a complaint with a supervisory authority (section 9).

How to use your rights: email hello@ara.ph with the subject "Privacy request", or write to the address in section 2. We may ask you to confirm your identity first. We respond within 30 days. Under the GDPR this is one month, which can be extended by up to two more months for complex requests; we will tell you if so. We don't charge a fee unless a request is clearly unfounded or excessive.

Under Philippine law, these rights may also be exercised by the data subject's lawful heirs and assigns.

9. Complaints

Please contact us first so we can try to resolve your concern. You also have the right to complain to:

• National Privacy Commission (Philippines): privacy.gov.ph. NPC rules generally require you to raise the issue with us first.
• If you are in the EU or EEA: the data protection supervisory authority where you live or work, or where the alleged infringement took place (GDPR Art. 77). A list is at edpb.europa.eu.

10. How we protect your information

We use organisational, physical and technical security measures appropriate to the risk, in line with RA 10173 and NPC Circular No. 2023-06, including:

• Encrypted connections (HTTPS/TLS) on our website and forms
• Protection against malicious traffic and denial-of-service attacks at our hosting provider, and spam protection on forms
• Multi-factor authentication and least-privilege access to our email, CRM and cloud accounts
• Endpoint protection and monitoring on company devices
• Access only for staff and providers who need it, under confidentiality obligations
• Written terms with our service providers
• Regular reviews of our security settings, and backups

Personal data breaches: we have a breach management procedure. Where a breach involves sensitive personal information, or information that could enable identity fraud, and is likely to give rise to a real risk of serious harm, we will notify the NPC and affected individuals within 72 hours of becoming aware of it, as required by NPC rules. Where the GDPR applies, we will notify the relevant EU supervisory authority within 72 hours where required (Art. 33), and affected people without undue delay where the risk is high (Art. 34).

No system is completely secure, so please also take care with what you share by email.

11. Cookies

Cookies are small files that a website stores in your browser; similar technologies include local storage. When you first visit ara.ph, our cookie notice lets you accept all, reject all or manage each category. Rejecting is as easy as accepting, and nothing optional runs until you choose. You can change your choice at any time through cookie settings (also in the footer of every page), or by clearing your browser storage.

We use Google Consent Mode: until you accept, Google Analytics and Google Ads tags are not loaded. If you later reject, we stop them and remove their cookies from your browser.