1. Privacy commitment and scope
Kzen PH Group, Inc. (Kzen PH, we, us, or our) respects privacy and is committed to protecting personal information processed through business.kzen.ph and related Kzen PH Consultancy services. This Policy applies to public visitors, prospective clients, clients, authorized representatives, vendors, applicants, and other individuals whose information is submitted to or processed through the Website, subject to the nature of the relevant activity.
This Policy is intended to provide transparency consistent with Republic Act No. 10173 (Data Privacy Act of 2012 or DPA), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC). It should be read with the Terms of Use and Cookie Policy and any applicable service or data-processing agreement.
2. Our privacy roles
Kzen PH may have different privacy roles depending on the processing activity. For information Kzen PH decides to collect and process for inquiry handling, service administration, Website security, billing, accounting, legal compliance, fraud prevention, records management, and its own business operations, Kzen PH acts as a Personal Information Controller (PIC).
When a client or other controller determines the purpose and means of processing and instructs Kzen PH to process personal information in connection with a consultancy service, Kzen PH may act as a Personal Information Processor (PIP). A separate data processing, outsourcing, or other written agreement may provide additional obligations for a particular engagement.
3. Categories of information
Depending on the service and your relationship with Kzen PH, we may process:
- Identity and contact: name, email, telephone/mobile number, business or mailing address, job title, designation, and representative information.
- Business and entity information: business name, trade name, legal structure, registration details, tax and government identifiers, principal address, branch information, ownership, officers, and representatives.
- Regulatory information: applications, registrations, licenses, permits, tax records, compliance records, government submissions, certificates, and related information.
- Identity and sensitive information: government-issued IDs, ID numbers, tax-related records, signatures, dates of birth, citizenship, residential information, and other sensitive personal information where reasonably required for an authorized service or legal obligation.
- Transaction information: inquiries, quotations, engagement details, job orders, invoices, payment references, communications, comments, and service status.
- Files and documents: files submitted for registration, licensing, compliance, permits, accreditation, or other consultancy work and relevant metadata.
- Technical and security information: IP address, approximate network-derived location where available, browser/device characteristics, operating system, user agent, timestamps, referrer information, requests, cookies or similar identifiers, and security events or logs.
4. Sources of information
We may receive information directly from you, an authorized representative, your organization, forms and documents you submit, public or government records, service providers acting on your behalf, or Website activity and security systems. If you provide information about another individual, you are expected to have the authority to do so and, where required, the appropriate notice, consent, or other lawful basis.
5. Purposes of processing
- responding to inquiries and consultation or quotation requests;
- providing registration, licensing, compliance, permit, tax, accreditation, and related consultancy services;
- communicating with clients, prospects, representatives, and authorized personnel;
- receiving, organizing, reviewing, submitting, and securely managing service documents;
- processing billing, payment confirmation, reconciliation, accounting, and transaction records;
- maintaining records for accountability, service administration, disputes, audits, and legal claims;
- maintaining, troubleshooting, improving, and securing the Website and infrastructure;
- detecting and preventing fraud, unauthorized access, abuse, malware, and security threats;
- complying with legal, regulatory, tax, accounting, court, government, and lawful law-enforcement requirements; and
- protecting the rights, property, safety, and legitimate interests of Kzen PH, clients, data subjects, and other persons.
6. Lawful bases
We process personal information only when permitted by applicable law. Depending on the circumstances, the lawful basis may include consent; contract or pre-contractual steps; legal obligation; and, where permitted, legitimate interests such as security, fraud prevention, service administration, records management, and protection of legal rights. Other lawful bases may apply where provided by the DPA or other applicable law.
Where consent is used, withdrawal does not invalidate processing already lawfully performed before withdrawal. Some services may no longer be available where the requested processing is necessary for the service or is otherwise required by law.
7. Sensitive personal information and data minimization
Some consultancy activities require sensitive personal information, including identification documents, tax records, signatures, and information required for regulatory or compliance work. We seek to limit collection to information reasonably necessary for the stated purpose and apply safeguards appropriate to the risk.
Please do not submit unnecessary sensitive information. Where a document contains unrelated personal information, use appropriate redaction or an alternative document where legally and operationally acceptable.
8. Client instructions and processor processing
When Kzen PH processes information on behalf of a client/controller, processing may include collection, recording, organization, storage, retrieval, consultation, transmission, disclosure to authorized recipients, updating, retention, restriction, deletion, or destruction as reasonably necessary to perform the applicable service.
Client instructions must be lawful, specific enough to perform the requested service, and consistent with applicable privacy and regulatory requirements. Kzen PH may refuse, suspend, or escalate an instruction where it reasonably believes the instruction is unlawful, unauthorized, unsafe, inconsistent with scope, or likely to compromise a data subject's rights or Website security.
9. Disclosure and authorized recipients
Personal information may be disclosed or made accessible where permitted or required by law and as reasonably necessary for the applicable purpose. Depending on the service, recipients may include government agencies and regulators such as the SEC, BIR, LGUs, FDA, PhilGEPS, and other authorities; authorized consultants, advisers, filing agents, accountants, legal professionals, couriers, or service providers; technology and infrastructure providers; payment or financial institutions where needed; and courts, law-enforcement bodies, regulators, auditors, or other lawful recipients.
We do not sell personal information or sensitive personal information for advertising or data-broker purposes, and we do not rent or trade client identity documents for commercial marketing.
10. Cross-border processing
Some technology providers or infrastructure used by the Website may process or store information outside the Philippines. Where personal information is transferred or made accessible across borders, Kzen PH will apply reasonable contractual, organizational, and technical safeguards and remain responsible for processing under its control to the extent required by applicable law.
11. Third-party service providers
The Website may use hosting, cloud, security, analytics, communications, content-delivery, form, advertising, or other technology providers. Providers may process technical or personal information as necessary to provide their services. Where Kzen PH engages a provider to process personal information on its behalf, Kzen PH will apply appropriate contractual and organizational controls consistent with applicable law and the nature of the processing.
12. Google services and advertising disclosures
If Kzen PH uses Google products or services on the Website, including Google Analytics, Google AdSense, or other Google advertising or measurement technologies, those services may collect, share, or use information such as cookies, device or browser information, IP address, identifiers, page or interaction information, and other technical information as described by the applicable Google service documentation and settings.
When advertising is enabled, Google and other third-party advertising technology providers may place and read cookies or use web beacons, IP addresses, or similar identifiers on visitors' browsers or devices in connection with ad serving, measurement, fraud prevention, frequency capping, and, where permitted and consented to, personalized advertising. Third-party vendors may also use information from prior visits to this or other websites to help provide or measure advertisements.
Where required, Kzen PH will request consent before using optional advertising or analytics technologies and will honor applicable consent signals. Advertising personalization may be unavailable when a visitor declines the relevant consent. Users can learn more about how Google uses data when using Google partner sites and services at How Google uses data when you use our partners' sites or apps.
Users may also manage Google's personalized advertising settings through Google Ads Settings. Kzen PH does not control Google's independent processing practices, and Google's own privacy policies and service terms may also apply.
13. Consent management for advertising and analytics
Kzen PH may use a consent management mechanism to allow visitors to make choices about optional cookies, analytics, advertising, and related technologies. Essential technologies remain active where necessary for security, consent storage, and core Website functions.
For visitors in jurisdictions where Google requires specific consent management for publisher advertising, Kzen PH will use the applicable Google-supported or Google-certified consent mechanism and configuration when Google advertising is enabled. In particular, Google requires publishers serving personalized ads to users in the European Economic Area, the United Kingdom, and Switzerland to use a Google-certified Consent Management Platform integrated with the IAB Transparency and Consent Framework.
Consent choices may be stored for a limited period and may be changed through the Website's privacy or cookie controls. The specific technologies and providers in use may change as the Website and advertising configuration changes.
14. Security measures
We maintain reasonable and appropriate organizational, physical, and technical safeguards designed to protect personal information against accidental or unlawful destruction, alteration, loss, unauthorized disclosure, or unauthorized access. Depending on the system and risk, safeguards may include HTTPS/TLS, access controls, least-privilege practices, logging and audit trails, secure session handling, backups, access reviews, malware controls, secure configuration, and secure disposal.
No internet-connected system can be guaranteed completely secure. You are responsible for using secure devices and promptly reporting suspected compromise.
15. Personal data breach response
Kzen PH maintains procedures for identifying, containing, investigating, documenting, and responding to suspected personal data breaches. Where notification is legally required, the applicable Personal Information Controller will notify the NPC and affected data subjects within periods prescribed by law. Where Kzen PH acts as a processor, it will assist the relevant controller as required by applicable law and the processing agreement.
16. Retention and disposal
Personal information is retained only as long as reasonably necessary for the purpose for which it was collected, to perform a service, maintain required business and transaction records, comply with legal or regulatory retention requirements, establish or defend legal claims, resolve disputes, protect security, or satisfy another lawful purpose. Retention periods vary by record type, service, legal requirements, regulatory requirements, and the relationship between Kzen PH and the client.
When information is no longer required, it will be securely deleted, destroyed, anonymized, or otherwise disposed of in accordance with applicable law and reasonable retention procedures. Some records may need to be retained after a service or inquiry ends.
17. Data subject rights
Subject to the conditions, exceptions, and limitations under the DPA and other applicable law, data subjects may have rights including the right to be informed; access personal information and certain processing information; correct inaccurate or incomplete information; object to certain processing; request erasure or blocking where legally applicable; exercise data portability where applicable; seek damages where provided by law; and lodge a complaint with the NPC.
Requests may be subject to identity or authority verification and lawful exceptions. Kzen PH may be unable to delete or restrict information where retention or processing is required by law, necessary for legal claims, required for an active service, or otherwise permitted by applicable law.
18. Requests, complaints, and verification
Privacy questions, requests, objections, or complaints may be sent to privacy@kzen.ph. Please provide enough information to identify the request and, where applicable, the relevant inquiry, client, service, or record. We may request reasonable proof of identity or authority before releasing, correcting, or changing personal information. You may also lodge a complaint with the NPC in accordance with its procedures.
19. Children and minors
The Website is primarily intended for business and professional transactions. We do not knowingly design the Website to collect children's personal information for unrelated purposes. Where a minor's information is legitimately required for a legal, regulatory, or service purpose, it should be submitted only by an authorized parent, guardian, representative, or other person with lawful authority, as applicable.
20. Automated processing and profiling
The Website may use automated technical processes for security, filtering, sorting, reporting, analytics, notifications, and other operational functions. We do not state that every automated process constitutes a decision producing legal or similarly significant effects. Where applicable law grants rights concerning automated processing or profiling, those rights will be respected subject to lawful exceptions.
21. Marketing communications
Where Kzen PH sends optional marketing or informational communications, recipients may use the available unsubscribe or opt-out mechanism or contact us to request cessation. Transactional, security, legal, service, or other necessary communications may continue where required for the relevant relationship or service.
22. Changes to this Privacy Policy
We may update this Policy when our services, technology, processing activities, legal obligations, advertising configuration, or security practices change. Material changes will be communicated where required by law. The current version published on this page identifies the applicable Policy.
23. Contact information
Personal Information Controller / Privacy Contact: Kzen PH Group, Inc.
Privacy email: privacy@kzen.ph
Website: business.kzen.ph
Where a formal Data Protection Officer is designated, the Company may provide the applicable DPO contact through the same channel or another published notice.