Privacy Policy: FLPC ERP (Web and Mobile)
Effective date: 22 October 2026
Last updated: 2 November 2026
1. Who we are
The FLPC ERP is the internal business system of Fighter Lock Philippines Corporation ("FLPC", "we", "us"), with principal office at No. 50 Madelaine Street, Parkway Village, Apolonio Samson, Quezon City 1106. It is available on the web at https://flpc.jomiecodefoundry.ph and as the "FLPC" mobile app for Android and iOS (together, the "System").
FLPC is the personal information controller for the personal data processed in the System. The System is built and supported for FLPC by Jomiecode Foundry OPC, which acts as FLPC's personal information processor under a written agreement and handles personal data only on FLPC's instructions.
This policy explains what personal data the System processes, why, who receives it, how long we keep it, and the rights you have under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission ("NPC").
2. Who this policy covers
The System is for authorised users only. This policy covers:
- FLPC employees and other personnel who have an account (including sales agents, drivers, warehouse staff, security guards, managers and administrators);
- job applicants who receive a link to take a pre-employment examination;
- contact persons of customers, suppliers and other business partners whose details are recorded in the System; and
- anyone who visits our public pages (login, this policy, the Terms of Use).
Your employment-related personal data is also covered by FLPC's employee privacy notice and HR policies. If they conflict on an employment matter, the employee privacy notice prevails.
3. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and login data | Name, work email, username, role and permissions, multi-factor authentication settings, login and session records | FLPC HR / administrators; you |
| Employment and HR data | Employee number, position, department, work site, reporting line, employment history, attendance, leave, overtime, performance appraisals, training, disciplinary and clearance records, documents you upload | FLPC HR; your managers; you |
| Payroll and government data (sensitive personal information) | Salary and allowances, deductions, loans and cash advances, bank account for payroll, Tax Identification Number (TIN), SSS, PhilHealth and Pag-IBIG numbers, tax and contribution records, age, civil status and dependents where needed for payroll or benefits | FLPC HR and payroll; you |
| Precise location | GPS / device location at the moment you clock in or out, and when you record field activity or deliveries that require it | Your device, only when you use those features |
| Photos and camera | Clock-in/out selfie (where your site's attendance policy requires it); photos of cheques, receipts, deliveries and field activity; QR codes scanned at secured gates | Your device camera or photo library, only when you take or choose a photo |
| Business transaction data | Sales orders, collections, cheque details, invoices, inventory movements, purchasing and accounting records, including the user who created or approved each record | You and other users |
| Business partner contact data | Names, positions, phone numbers and emails of customer and supplier contact persons | FLPC staff; the business partner |
| Applicant data | Name, contact details, the position applied for, exam answers and scores | You (through the exam link); FLPC HR |
| Device and technical data | Push-notification token, device type and operating-system version, app version, IP address, browser type, error reports, timestamps and audit logs of what was viewed or changed | Your device and browser; our servers |
| Support data | Messages and attachments you send to support | You |
We do not collect: fingerprints or face data. If you turn on fingerprint or face unlock in the mobile app, the check is performed by your phone's operating system; the System only receives a yes/no result and never receives your biometric data. Clock-in selfies are stored as ordinary photos for attendance verification; we do not run facial recognition on them.
We do not use advertising identifiers, we do not track you across other companies' apps or websites, and we do not sell personal data.
4. Why we use it, and on what basis
| Purpose | Lawful basis (RA 10173) |
|---|---|
| Creating and securing your account, signing you in, multi-factor authentication | Necessary for the employment relationship / contract (Sec. 12(b)); FLPC's legitimate interest in securing its systems (Sec. 12(f)) |
| HR administration: attendance, leave, overtime, appraisals, training, discipline, clearance | Contract of employment (Sec. 12(b)); compliance with labour law (Sec. 12(c)) |
| Payroll, tax withholding, government contributions and BIR, SSS, PhilHealth and Pag-IBIG reporting | Required by law and regulation (Sec. 13(b)); employment contract (Sec. 12(b)) |
| Verifying attendance with location and selfie (only at clock-in/out, only at sites where FLPC has enabled it) | FLPC's legitimate interest in accurate timekeeping and preventing time fraud (Sec. 12(f)), limited as described in section 5 |
| Recording and approving sales, collections, inventory, purchasing and accounting transactions | Contract with FLPC's customers and suppliers, and FLPC's legitimate business interests (Sec. 12(b), (f)) |
| Keeping books of account, audit trails and sequential documents | Required by tax law and BIR Computerized Accounting System rules (Sec. 12(c), 13(b)) |
| Pre-employment examinations | Steps you asked for before entering an employment contract (Sec. 12(b)) |
| Sending in-app and push notifications about approvals and tasks | Employment contract and legitimate interest (Sec. 12(b), (f)). You can turn push notifications off in your phone's settings |
| Keeping the System secure, fixing errors, preventing misuse, investigating incidents | Legitimate interest (Sec. 12(f)) |
| Responding to lawful requests from courts and government agencies; establishing or defending legal claims | Legal obligation (Sec. 12(c)); legal claims (Sec. 13(f)) |
We use personal data only for the purposes above, or for compatible purposes we tell you about first. Where the law requires your consent, we will ask for it separately, and you may withdraw it at any time without affecting earlier processing.
5. Location and camera
- When location is read: only at the moment you clock in or out, or when you record a field activity or delivery that requires it. The System does not track your location in the background or outside these actions.
- Why: to confirm that you are at your assigned work site (within the site's configured radius) or at the customer location you recorded.
- What is stored: the coordinates and time of that one action, the distance from the site, and whether the action was accepted. This is linked to your attendance or activity record.
- Camera and photos: used only when you take or choose a photo for a feature that needs one. The app does not access your photo library in the background.
- Your choice: you can refuse or withdraw location and camera permission in your phone or browser settings. Some features may then be unavailable, or FLPC's attendance policy may require you to clock in another way.
6. Who we share it with
We share personal data only as needed for the purposes above:
- Within FLPC, with personnel who need it for their role. Access is controlled by role and reporting line; for example, managers see the records of their own team.
- Service providers (personal information processors) acting on our instructions under contracts that require confidentiality and security:
- Jomiecode Foundry OPC (Philippines): builds, hosts and supports the System;
- Amazon Web Services (servers in Singapore,
ap-southeast-1): hosting, database, file storage, sign-in and multi-factor authentication (Amazon Cognito), email and SMS delivery; - Google (Firebase Cloud Messaging) and Apple (Push Notification service): delivering push notifications to the mobile app;
- Government agencies as required by law, including the BIR, SSS, PhilHealth, Pag-IBIG Fund, DOLE, the NPC, courts and law-enforcement agencies acting under lawful authority.
- Banks, to credit payroll and process payments.
- Professional advisers and auditors, under confidentiality.
- A successor or acquirer if all or part of FLPC's business is reorganised, merged or sold. We will tell you first.
We do not sell, rent or trade personal data, and we do not share it with anyone for their own marketing.
7. Transfers outside the Philippines
Some of our service providers store or process data outside the Philippines, including in Singapore (AWS) and the United States (Google and Apple). FLPC remains responsible for that data under Section 21 of RA 10173 and uses contracts and other reasonable means to ensure it receives a comparable level of protection.
8. How long we keep it
We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires:
| Record | Retention |
|---|---|
| Books of account, invoices, receipts, payroll and tax records, and their audit trail | For the period the National Internal Revenue Code and BIR regulations require (10 years), and longer while a tax audit or case is pending |
| Employment records (201 file, attendance, payroll) | For the duration of employment plus 4 years, or longer where the Labor Code, social-security laws or a pending claim requires |
| Clock-in selfies and attendance location points | 12 months after the related payroll period is closed, unless needed for a dispute |
| Applicant data (not hired) | 12 months after the hiring decision |
| Security and access logs | 12 months |
| Push-notification tokens | Until you sign out, uninstall the app, or your account is closed |
Records that tax law or the BIR's Computerized Accounting System rules require us to keep unaltered (such as the audit trail of posted transactions) cannot be deleted during the retention period. When the retention period ends, we securely delete or anonymise the data.
9. How we protect it
We use organisational, physical and technical measures appropriate to the risk, including: encryption in transit (HTTPS/TLS) and at rest; multi-factor authentication; role-based access control and need-to-know access; secure storage of sign-in tokens on your device; audit logging of access and changes; removal of personal data from error reports and logs; and regular backups. No system is perfectly secure. If a personal data breach occurs that is likely to cause you serious harm, we will notify you and the NPC as required by NPC Circular 16-03.
10. Your rights
Under RA 10173 you have the right to:
- be informed about how your personal data is processed;
- access your personal data and obtain a copy;
- correct inaccurate or incomplete data. You can update some details yourself in Self-Service (My Profile);
- object to processing, and to withdraw consent where processing is based on consent;
- erasure or blocking of data that is incomplete, outdated, false, unlawfully obtained or no longer needed, subject to legal retention duties;
- data portability: receive your data in a commonly used electronic format;
- damages for inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of personal data; and
- file a complaint with the National Privacy Commission (www.privacy.gov.ph).
To exercise a right, contact our Data Protection Officer (section 11). We may need to verify your identity. We will respond within 30 days. Some rights are limited by law; for example, we cannot erase payroll or tax records we are required to keep.
Closing your account: System accounts are issued and closed by FLPC HR when your work with FLPC ends. To ask for your account to be closed or your data to be deleted earlier, contact the Data Protection Officer or email privacy@flpc.com.ph.
11. Contact our Data Protection Officer
Data Protection Officer, Fighter Lock Philippines Corporation Data Protection Officer No. 50 Madelaine Street, Parkway Village, Apolonio Samson, Quezon City 1106 Email: privacy@flpc.com.ph
12. Children
The System is for FLPC personnel, job applicants and business contacts. It is not intended for anyone under 18, and we do not knowingly collect personal data from children through it. FLPC has no applicants or interns under 18.
13. Cookies and local storage
The web application uses only strictly necessary cookies and browser storage to keep you signed in, remember your session and security settings, and protect against misuse. We do not use advertising or third-party analytics cookies. The mobile app stores your sign-in token in your phone's secure storage.
14. Changes to this policy
We may update this policy when the System or the law changes. We will post the new version at https://flpc.jomiecodefoundry.ph/privacy and in the app with a new "Last updated" date, and will notify users in the System of material changes before they take effect.