Back to ThePOD
NPC & RA 10173 Compliant

Legal & Regulatory Compliance

Privacy Policy & Data Subject Notice

In compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and the National Privacy Commission (NPC) Implementing Rules and Regulations.

Last Updated: November 2026 • Towns I.T Services • DPO Contact: dpo@townsitservices.com

1. Introduction & Roles under RA 10173

This Privacy Policy governs the processing of personal data by ThePOD, an autonomous multi-tenant print shop operating system developed and operated by Towns I.T Services (https://townsitservices.com).

Under Republic Act No. 10173:

  • Personal Information Controller (PIC): The individual print shop or apparel decorator enterprise ("Tenant") with whom you interact, request quotations from, or place printing orders.
  • Personal Information Processor (PIP): Towns I.T Services / ThePOD, operating the multi-tenant cloud software, database, and infrastructure on behalf of the PIC.

2. Categories of Personal Data Collected

We collect and process only the minimum personal data necessary to provide accurate quotations, fulfill manufacturing orders, and issue lawful BIR sales receipts:

Identity & Contact Data

Customer full name, mobile number, email address, physical delivery/counter collection address, and organization/company name.

Tax & Billing Data

BIR Tax Identification Number (TIN), registered business style, withholding tax certificates (BIR Form 2307), and payment transfer reference screenshots.

Manufacturing Specifications

Uploaded 2D/3D artwork files, apparel sizing rosters, color separations, custom text/names, and proofing approval digital signatures with timestamps.

Forensic Security & Audit Data

Connecting IP address (via Cloudflare edge), browser User-Agent, authentication timestamps, and immutable audit logs.

3. Purpose of Processing & Legal Basis

Personal data is processed pursuant to Section 12 of RA 10173 on the following lawful bases:

  • Consent (Sec. 12[a]): Freely given consent provided during web intake submission or artwork approval.
  • Contractual Fulfillment (Sec. 12[b]): Processing print jobs, generating production Kanban tickets, scheduling courier delivery, and managing customer communications.
  • Statutory Compliance (Sec. 12[c]): Issuance of BIR-compliant Sales Invoices (SI) and Official Receipts under Philippine Tax regulations (RR 18-2012 and EOPT Act).
  • Legitimate Interests (Sec. 12[f]): Preventing fraud, defending against disputed print proofs, and maintaining system security.

4. Rights of the Data Subject (NPC Mandate)

Under Section 16 of RA 10173, every data subject is entitled to the following non-waivable rights:

Right to be Informed: You have the right to know how your personal data will be processed prior to collection.
Right to Access & Data Portability: You may request a machine-readable JSON export of all personal data, quotes, and orders via our Data Portability API.
Right to Rectification: You may update or correct inaccurate contact information at any time.
Right to Erasure / Anonymization: You may request the permanent anonymization of your personal data. Personal details will be scrubbed, while anonymized transaction ledger totals are preserved to satisfy mandatory BIR tax audits.
Right to File a Complaint: If your rights are violated, you may file a complaint with the National Privacy Commission (NPC) at https://privacy.gov.ph or email complaints@privacy.gov.ph.

5. Data Retention & Disposal

Personal data is retained only for as long as necessary to fulfill the operational purpose for which it was collected. Pursuant to the National Internal Revenue Code (NIRC) and BIR Revenue Regulations (RR No. 5-2014), books of accounts and subsidiary sales invoices must be retained for ten (10) years. Upon expiration of statutory periods or upon customer erasure request, PII is permanently anonymized or destroyed using cryptographic erasure.

6. Technical & Organizational Safeguards

  • Row-Level Tenant Isolation: Zero-leak multi-tenant architecture strictly preventing shop data overlap.
  • Encryption: All data in transit is encrypted using TLS 1.3/1.2; data at rest is encrypted using AES-256 in Google Cloud.
  • Forensic Audit Trails: Read-only, append-only logs capturing IP addresses, user agents, and timestamps.
  • Incident Management: Documented Personal Data Breach Management protocol complying with NPC Circular 16-03.

Data Protection Officer (DPO) Contact

For questions regarding this policy, exercising your Data Subject Rights (Access, Portability, Erasure), or reporting security concerns, please contact our Data Protection Office:

Entity: Towns I.T Services (ThePOD Platform Operator)

Designation: Data Protection Officer

Email: dpo@townsitservices.com

Website: https://townsitservices.com

© 2026 Towns I.T Services. All rights reserved. Compliant with Republic Act No. 10173.