Privacy Policy
Effective 2026-08-07 · Version 1.0
CO.OP NDS respects your privacy. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have under Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).
We are the Personal Information Controller for the data described here.
1. Data we collect
Information you give us
- Full name, service and billing address, barangay and municipality
- Mobile number, landline, and email address
- Government-issued identification presented at application, and proof of billing address
- Account preferences, service plan, and installation details
- Support tickets, service requests, and correspondence with our staff
- Images of deposit slips or payment receipts you upload to prove payment
Information generated by your use of the service
- Account number, invoice and receipt records, payment history, credit balance, and adjustments
- Technical identifiers needed to deliver service: PPPoE username, assigned IP address, ONU or modem serial number, optical signal levels, and the network port serving your line
- Session connection and disconnection times, and bandwidth utilization totals, used for capacity planning and fault diagnosis
- Client portal login records
What we do not collect
- We do not store your full card number, expiry date, or CVV. Card details are entered directly with our payment processor.
- We do not inspect, record, or retain the content of your internet traffic, the websites you visit, or your messages, except where a lawful order from a competent Philippine authority requires it.
2. Why we process your data
| Purpose | Legal basis under RA 10173 |
|---|---|
| Delivering internet service, provisioning your line, and technical support | Performance of our contract with you |
| Billing, invoicing, receipting, and collection | Performance of our contract; legal obligation |
| Processing payments and confirming settlement | Performance of our contract |
| Service notices, outage alerts, due-date reminders, and suspension notices | Performance of our contract; our legitimate interest in keeping you informed |
| Fraud prevention, network security, and abuse investigation | Our legitimate interest; legal obligation |
| Tax, accounting, cooperative reporting, and regulatory filings | Legal obligation |
| Promotional offers and new service announcements | Your consent, which you may withdraw at any time |
3. Who we share your data with
We do not sell your personal data. We share it only with the following categories of recipients, and only to the extent necessary:
| Recipient | What is shared | Why |
|---|---|---|
| PayMongo Philippines, Inc. | Name, email, mobile number, invoice reference, amount | To process card and e-wallet payments. PayMongo is supervised by the Bangko Sentral ng Pilipinas and handles card data under PCI DSS. |
| SMS gateway provider | Mobile number, message content | To send billing reminders, outage alerts, and service notices. |
| Email service provider | Email address, message content | To deliver statements and notices. |
| Meta Platforms (Facebook Messenger) | Your Messenger identifier and the messages you send us | Only where you choose to contact us through our Facebook page. |
| Automated receipt-reading service | The receipt or deposit slip image you upload | To read the amount, date, and reference number automatically so your payment posts faster. The image is processed for this purpose only and is not used to train any third party's systems. This processing may occur on servers outside the Philippines. |
| Cloud hosting provider | Data stored in our system | To host our servers. Access is restricted to authorized personnel. |
| Government authorities | Only what is specifically required | Where compelled by subpoena, court order, or a lawful directive from the NTC, BIR, CDA, NPC, or law enforcement. |
Where a recipient processes data on our behalf, we require it by contract to protect the data, use it only for the stated purpose, and delete or return it when the engagement ends. Where data is processed outside the Philippines, we take steps to ensure a comparable level of protection as required by RA 10173.
4. How long we keep your data
- Billing, invoice, receipt, and payment records: ten (10) years from the end of the taxable year, consistent with BIR retention rules.
- Subscriber account and identification records: for the duration of your subscription and five (5) years after disconnection, for collection, audit, and regulatory purposes.
- Network session and technical logs: normally twelve (12) months.
- Support tickets and correspondence: three (3) years.
- Uploaded receipt images: retained with the corresponding payment record.
After the retention period, records are securely deleted or anonymized.
5. How we protect your data
- Encrypted connections (HTTPS/TLS) for the client portal and all payment flows
- Encrypted storage of sensitive credentials and integration keys
- Role-based access control: staff can only see what their role requires, and access is logged
- Individual named accounts for staff, with no shared logins for privileged functions
- Automated encrypted backups with integrity verification
- Restricted, authenticated administrative access to our servers
No system is perfectly secure. In the event of a personal data breach likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected data subjects within seventy-two (72) hours of knowledge of the breach, as required by law.
6. Your rights as a data subject
Under RA 10173 you have the right to:
- Be informed that your personal data is being processed;
- Access the personal data we hold about you;
- Object to processing, including direct marketing;
- Rectify inaccurate or incomplete data;
- Erasure or blocking of data that is unlawfully obtained, no longer necessary, or processed beyond its purpose;
- Damages for violations of your rights;
- Data portability — to obtain a copy of your data in a commonly used electronic format;
- File a complaint with the National Privacy Commission.
To exercise any of these rights, contact our Data Protection Officer using the details below. We will respond within a reasonable period, ordinarily within fifteen (15) working days. We may ask you to verify your identity first. Note that some requests cannot be fully granted where we are legally required to keep the records, for example billing records under BIR rules.
7. Cookies
Our website and client portal use only the cookies necessary to keep you signed in and to keep your session secure. We do not use advertising or cross-site tracking cookies. You may block cookies in your browser, but the client portal will not function without session cookies.
8. Children
Our service is contracted by adults. We do not knowingly collect personal data directly from children. Where a household includes minors, the account holder remains responsible for the subscription.
9. How to reach us about your data
Send any request under Section 6 — access, correction, deletion, objection, or a copy of your data — to the contact below. Please write "Data Privacy Request" in the subject line so it reaches the right person quickly.
- Email: [email protected]
- Contact number: 099999999
- Address: T. Camacho, Balanga, Bataan
10. Complaints
If you are not satisfied with how we handled your concern, you may lodge a complaint with the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Pasay City, Metro Manila — privacy.gov.ph.
11. Changes to this policy
We may update this Privacy Policy. The current version and its effective date are always shown on this page. Material changes will be notified through the client portal, SMS, or email.