As a PIC, MFRI hereby adopts this Privacy Manual in compliance with the DPA, its IRR, and other relevant policies, including issuances of the NPC (collectively, the “Data Privacy Laws”). The purpose of this Privacy Manual is to provide the shareholders, officers, employees, agents, representatives, other personnel, contractors, service providers, and suppliers (the “Personnel”) of MFRI and its subsidiaries with appropriate guidelines in respect of the (i) lawful processing and management of Personal Data, and (ii) exercise of their rights under the Data Privacy Laws in adherence to the general principles of transparency, legitimate Purpose, and proportionality.

 

Rights of the Data Subjects

• Right to be informed

• Right to object

• Right to access

• Right to rectification

• Right to erasure or blocking

• Right to damages

 

Processing of Personal Data

1. Consent of the Data Subject should be procured prior to the collection and Processing of Personal Data, subject to exemptions provided by the Data Privacy Laws.

2. The Data Subject should be informed of the nature and extent of Processing.

3. Processing should ensure data quality.

4. Personal Data shall not be retained longer than necessary.

5. Any authorized further Processing shall have adequate safeguards.

 

Collection of Personal Data

1. MFRI shall collect basic Personal Data of all its applicants, prospective clients and clients, employees, on-the-job trainees, sales agents/brokers, and independent contractors. The Personal Data to be collected may include the Data Subject’s full name, home or business address, email address, contract number, together with other information necessary to complete the details or the Purpose of the Personal Data.

2. MFRI shall only collect Sensitive Personal Information that is reasonably necessary for one or more of MFRI’s functions or activities and with the Data Subject’s consent or if the collection is Required by Law.

3. MFRI shall only collect Personal Data that is reasonably necessary for or directly related to MFRI’s functions or activities.

4. Personal Data should be collected only by lawful and fair means and not in an intrusive way.

5. During the collection of Personal Data from the Data Subjects, reasonable steps should be undertaken by MFRI’s Personnel to ensure that the Data Subject is furnished with the information required as follows: The Data Subject shall be notified and furnished with information indicated hereunder before the entry of his or her Personal Data into the Data Processing System of the Personal Information Controller, or at the next practical opportunity:

a) Description of the Personal Data to be entered into MFRI’s Filing System;

b) Purposes for which they are being or will be Processed;

c) Basis of Processing, when Processing is not based on the Consent of the Data Subject;

d) Scope and method of the Personal Data Processing;

e) The recipients or classes of recipients to whom the Personal Data are or may be disclosed;

f) Methods utilized for automated access, if the same is allowed by the Data Subject, and the extent to which such access is authorized, including meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing for the Data Subject;

g) The identity and contact details of the PIC (MFRI or other PICs, as applicable) or its representative;

h) The period for which the Personal Data will be stored; and

i) The existence of their rights as Data Subjects, including the right to access, correction, and object to the Processing, as well as the right to lodge a complaint before the NPC.

6. MFRI’s Personnel will only collect Personal Data directly from the Data Subject. If the Personal Data will be collected from a party other than the Data Subject, the Personnel should ensure that the concerned Data Subject (i) is made fully aware of the circumstances under which the latter’s Personal Data was collected, and (ii) has consented to the collection and Processing of his or her Personal Data.

 

Use and Further Processing of Personal Data

1. MFRI has reason to suspect that an unlawful activity has been, or may be engaged in, and uses or Processes the Personal Data as a necessary part of its investigation of the matter for the purpose of establishing, exercising, or defending legal claims, or reporting its concerns to the Public Authorities;

2. The use or Processing is Required by Law; or

3. MFRI reasonably believes that the use or Processing of the Personal Data is necessary to prevent or lessen a serious and imminent threat to public health or public safety or to protect the life or health of a Data Subject.

 

Disclosure and Sharing of Personal Data

All MFRI Personnel shall maintain the confidentiality and secrecy of all Personal Data that come to their knowledge and possession, even after resignation, termination of contract, or other contractual relations. Personal Data under the custody of MFRI shall be disclosed only pursuant to a lawful Purpose, and to authorized recipients of such Personal Data.