Issued pursuant to Republic Act No. 10173 — Data Privacy Act of 2012 and its Implementing Rules and Regulations
1. Introduction
Property Title Management ("PTM", "we", "us"), operated by 8REC Solutions, is a Personal Information Controller (PIC) as defined under Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform at ptm.8rec.com.
By creating an account or using PTM, you expressly consent to the collection and processing of your personal data as described in this policy.
2. Personal Information We Collect
- Account information: Full name, email address, and authentication credentials.
- Uploaded documents: Scanned title documents (Certified True Copies), images, and PDF files you upload. These may contain personal information about landowners as recorded in the Land Registration Authority.
- Usage data: Actions performed within the platform (searches, uploads, views) for security, audit trail, and service improvement purposes.
- Payment records: Credit top-up requests, selected payment channel, and proof of payment images. We do not collect or store credit card numbers.
- Technical data: IP address, browser type, and session identifiers, collected automatically for security and fraud prevention.
3. Purpose of Processing
We process your personal information for the following declared, specified, and legitimate purposes:
- To create and maintain your account and organization
- To deliver the title document management service you signed up for
- To process AI-powered extraction of data from uploaded documents
- To facilitate credit top-up requests and billing
- To ensure platform security, prevent unauthorized access, and detect fraud
- To comply with applicable Philippine laws and regulations
4. Legal Basis for Processing
Under the Data Privacy Act of 2012, we process your personal data on the following bases:
- Consent (Sec. 12[a]): You expressly consent at signup to the collection and processing of your personal data for the purposes stated in this policy.
- Contractual necessity (Sec. 12[b]): Processing is necessary to fulfill the service agreement between you and PTM.
- Legitimate interests (Sec. 12[f]): Security monitoring, fraud prevention, and service improvement, balanced against your rights and freedoms.
5. Data Storage and Security
All data is stored on Google Cloud Platform infrastructure in the asia-southeast1 (Singapore) region. We implement the following security measures:
- Encryption at rest: AES-256-GCM with unique per-organization encryption keys stored in Google Secret Manager
- Encryption in transit: TLS 1.3 for all data transfers
- Access control: Organization-level data isolation — users can only access data belonging to their own organization
- Authentication: Secure session cookies (HttpOnly, Secure, SameSite=Strict), no tokens stored in localStorage
6. Data Retention
- Account data: Retained for the duration of your account. Deleted upon account closure.
- Scanned title records: Retained for one (1) year from the date of upload, then automatically deleted.
- Audit logs: Retained for six (6) months for security and compliance purposes.
- Payment proof images: Retained for two (2) years for financial record-keeping compliance.
You may request earlier deletion of your data by closing your account via Account Settings or by contacting us.
7. Your Rights Under the Data Privacy Act of 2012
As a data subject under RA 10173, you have the following rights:
- Right to be informed: To know how your personal data is being collected and processed (this policy).
- Right to access: To obtain a copy of your personal data. Use Account → Export your data to download a machine-readable copy.
- Right to rectification: To correct inaccurate or incomplete personal data.
- Right to erasure or blocking: To request deletion of your personal data. Use Account → Delete account or contact us.
- Right to data portability: To receive your data in a structured, commonly used, machine-readable format (JSON export).
- Right to object: To object to the processing of your personal data in certain circumstances.
- Right to lodge a complaint: To file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph if you believe your rights have been violated.
- Right to damages: To be indemnified for any damages sustained due to inaccurate, incomplete, or unauthorized processing of your data.
To exercise any of these rights, contact our Data Protection Officer at privacy@8rec.com.
8. Data Breach Notification
In the event of a personal data breach that is likely to result in serious harm, we will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and affected data subjects within a reasonable period thereafter, in accordance with NPC Circular 16-03.
9. Cookies
We use a single session cookie (__ptm_session) strictly necessary for authentication. We do not use advertising, tracking, analytics, or third-party cookies. This cookie is automatically deleted when your session expires or you sign out.
10. Third-Party Processors
We share data with the following third-party processors only as necessary to deliver the service. Each is bound by data processing agreements:
- Google Firebase / Firestore: Authentication and database storage (Google Cloud, Singapore region)
- Google Cloud Storage: Uploaded document file storage
- Anthropic Claude API: AI-powered document processing. Documents submitted for OCR are processed under Anthropic's privacy policy. Anthropic does not use your documents to train AI models.
- Google Secret Manager: Secure storage of encryption keys
11. Contact — Data Protection Officer
For privacy inquiries, to exercise your rights, or to reach our Data Protection Officer: