Privacy Policy

1. Privacy Commitment and Scope

Kzen PH Group, Inc. ("Kzen PH", "we", "us", or "our") respects privacy and is committed to protecting personal information processed through portal.kzen.ph and related services. This Policy applies to public visitors, account holders, clients, authorized representatives, staff users, applicants and other individuals whose information is submitted to or processed through the Portal.

This Policy is intended to provide the transparency required by Republic Act No. 10173 (Data Privacy Act of 2012 or "DPA"), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission ("NPC"). It should be read together with the Terms of Service and Cookie Policy.

2. Our Role: Controller and Processor

Kzen PH may have different privacy roles depending on the processing activity. For information Kzen PH decides to collect and process for account administration, Portal security, service administration, billing, accounting, legal compliance, fraud prevention, audit, and its own business operations, Kzen PH acts as a Personal Information Controller (PIC).

When a client or other controller determines the purpose and means of processing and instructs Kzen PH to process personal information in connection with a service or job order, Kzen PH may act as a Personal Information Processor (PIP). In those circumstances, Kzen PH processes the information only within the authorized scope and applicable instructions, subject to legal requirements.

A separate data processing, outsourcing, or other written agreement may provide additional obligations for a particular client engagement. Nothing in this public Policy is intended to replace a specific contractual arrangement where one exists.

3. Categories of Personal Information We May Process

Depending on the service and your relationship with Kzen PH, we may process:

• Identity and contact information: name, email address, telephone/mobile number, mailing or business address, job title, designation, and representative information.
• Business and entity information: business name, trade name, legal structure, registration details, tax and government identifiers, principal address, branch information, ownership and representative information.
• Government and regulatory information: information appearing in applications, registrations, licenses, permits, tax records, regulatory submissions, and related government documents.
• Identity documents and sensitive information: government-issued IDs, ID numbers, tax returns or tax-related records, signatures, dates of birth, citizenship, residential information, and other sensitive personal information where required for an authorized service or legal obligation.
• Authentication information: account identifiers, password hashes, OTP-related records, authentication events, session information, and account-security records. Plaintext passwords are not intentionally stored as readable account data.
• Transactions and service records: job orders, billing records, payment references, proof of payment, invoices, service communications, comments, status histories, and related correspondence.
• Files and documents: files uploaded by clients or staff, document classifications, purposes, metadata, access/visibility settings, and records associated with a job order or client.
• Technical and security information: IP address, approximate location derived from network information where available, browser and device characteristics, operating system, user-agent, timestamps, referrer information, request information, security events, and audit logs.
• Google authentication information: where Google Sign-In is used, identifiers and profile information made available through the authentication flow, subject to Google's applicable policies and the permissions granted.

4. Sources of Information

We may receive personal information directly from you, from an authorized representative, from your organization or employer, from documents you upload, from government or public records, from service providers acting on your behalf, from authentication providers such as Google where you choose that sign-in method, and from Portal activity or security systems.

If you provide personal information about another individual, you are expected to have the authority to do so and, where required, to have provided the appropriate privacy notice or obtained the appropriate consent or other lawful basis.

5. Purposes of Processing

• creating and administering user accounts and client records;
• authenticating users and protecting accounts;
• processing OTPs, security alerts, password-related requests, and operational communications;
• receiving, organizing, reviewing, and securely managing client documents and files;
• creating, processing, monitoring, and documenting job orders;
• performing registration, licensing, tax, compliance, administrative, and filing services requested by clients;
• processing billing, payment confirmation, reconciliation, accounting, and financial records;
• communicating with clients, representatives, and authorized staff regarding services;
• maintaining audit trails, records of changes, access logs, and evidence needed for security, accountability, and dispute resolution;
• detecting and preventing fraud, unauthorized access, abuse, malware, and other security threats;
• complying with legal, regulatory, tax, accounting, court, government, and law-enforcement requirements;
• maintaining, troubleshooting, improving, and securing the Portal and its infrastructure; and
• protecting the rights, property, safety, and legitimate interests of Kzen PH, clients, data subjects, and other persons.

6. Lawful Bases for Processing

We process personal information only when permitted by applicable law. Depending on the circumstances, the lawful basis may include:

• Consent: where consent is the appropriate legal basis and has been validly obtained.
• Contract or pre-contractual steps: where processing is necessary to provide requested services, manage an account, process a job order, or take steps requested before entering into an agreement.
• Legal obligation: where processing is required by law, regulation, government authority, tax/accounting requirements, court order, or other lawful mandate.
• Legitimate interests: where permitted by law, including security, fraud prevention, service administration, records management, and protection of legal rights, provided the processing does not override applicable rights and protections.
• Protection of vital interests or public authority: where applicable under the DPA and other law.

Consent is not treated as the legal basis for processing where another lawful basis applies and consent is not required. Where consent is used, withdrawal will not invalidate processing already lawfully performed before withdrawal, and some services may no longer be available if the requested processing is necessary for the service.

7. Sensitive Personal Information and High-Risk Documents

Some Portal activities require sensitive personal information, including government-issued identification, tax-related records, signatures, and other information required for regulatory or compliance work. We seek to limit such collection to information reasonably necessary for the stated purpose and apply additional access, security, and handling controls appropriate to the risk.

Clients and authorized representatives should not upload unnecessary sensitive information. Where an image or document contains unrelated personal information, you should use an appropriate redaction or alternative document where legally and operationally acceptable.

8. Data Processing and Client Instructions

When Kzen PH processes personal information on behalf of a client/controller, the processing may include collection, recording, organization, storage, retrieval, consultation, transmission, disclosure to authorized recipients, updating, retention, restriction, deletion, or destruction, as reasonably necessary to perform the applicable service.

Client instructions must be lawful, specific enough to perform the requested service, and consistent with applicable privacy and regulatory requirements. Kzen PH may refuse, suspend, or escalate an instruction where it reasonably believes the instruction is unlawful, unauthorized, unsafe, inconsistent with the agreed service scope, or likely to compromise the rights of a data subject or the security of the Portal.

Where a client/controller uses Kzen PH as a processor, the parties may execute an appropriate data processing or outsourcing agreement addressing confidentiality, security, subprocessors, breach assistance, retention, return/deletion, audit or compliance assistance, and other processor obligations.

9. Disclosure, Data Sharing, and Authorized Recipients

Personal information may be disclosed or made accessible only where permitted or required by law and as reasonably necessary for the applicable purpose. Recipients may include:

• Government agencies and regulators: SEC, BIR, LGUs, FDA, PhilGEPS and other government or regulatory bodies, as applicable to a client's requested service.
• Professional and service partners: authorized consultants, advisers, couriers, filing agents, accountants, legal professionals, or other service providers where required for the engagement.
• Technology and infrastructure providers: cloud hosting, database, file storage, authentication, security, email, communications, and related infrastructure providers acting under appropriate contractual or lawful arrangements.
• Payment and financial institutions: where needed to confirm, reconcile, or document a transaction.
• Authorities and legal recipients: courts, law-enforcement bodies, regulators, auditors, or other parties where disclosure is required or authorized by law.

We do not sell personal information or sensitive personal information for advertising or data-broker purposes. We do not rent or trade client identity documents for commercial marketing.

10. Cross-Border Processing and Third-Party Infrastructure

Some technology providers or infrastructure used by the Portal may process or store information outside the Philippines. Where personal information is transferred or made accessible across borders, Kzen PH will apply reasonable contractual, organizational, and technical safeguards and remain responsible for processing under its control to the extent required by applicable law.

Cross-border processing may involve services such as cloud infrastructure, authentication, email delivery, security, content delivery, or other technology required to operate the Portal. The identity and practices of third-party providers may change as infrastructure evolves, subject to applicable law and contractual obligations.

11. Security Measures

We maintain reasonable and appropriate organizational, physical, and technical safeguards designed to protect personal information against accidental or unlawful destruction, alteration, loss, unauthorized disclosure, or unauthorized access. Depending on the system and risk, safeguards may include HTTPS/TLS, secure authentication, role-based access controls, least-privilege access, logging and audit trails, secure session handling, backups, access reviews, malware controls, and secure disposal procedures.

No internet-connected system can be guaranteed to be completely secure. Users are responsible for using secure devices, protecting credentials and OTPs, and reporting suspected compromise promptly.

12. Personal Data Breach Response

Kzen PH maintains procedures for identifying, containing, investigating, documenting, and responding to suspected personal data breaches. Where notification is legally required, the applicable Personal Information Controller will notify the National Privacy Commission and affected data subjects within the periods prescribed by law, including the applicable seventy-two (72) hour requirement for reportable breaches.

Where Kzen PH acts as a processor, it will assist the relevant controller as required by applicable law and the applicable processing agreement, including providing relevant incident information and reasonable cooperation.

13. Retention and Secure Disposal

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected, to perform the applicable service, maintain required business and transaction records, comply with legal and regulatory retention requirements, establish or defend legal claims, resolve disputes, protect security, or satisfy another lawful purpose.

There is no single retention period for all information. Retention may vary according to the record type, service, account status, legal requirements, tax and accounting obligations, regulatory requirements, dispute status, security needs, and the relationship between Kzen PH and the client.

When information is no longer required, it will be securely deleted, destroyed, anonymized, or otherwise disposed of in accordance with applicable law and reasonable retention/disposal procedures. Some records may need to be retained even after an account is closed.

14. Data Subject Rights

Subject to the conditions, exceptions, and limitations under the DPA and other applicable law, data subjects may have rights including:

• the right to be informed about processing;
• the right to access personal information and certain information about its processing;
• the right to correct inaccurate or incomplete information;
• the right to object to certain processing;
• the right to request erasure or blocking where legally applicable;
• the right to data portability where applicable;
• the right to damages where provided by law; and
• the right to lodge a complaint with the National Privacy Commission.

Requests may be subject to identity verification and lawful exceptions. Kzen PH may be unable to delete or restrict information where retention or processing is required by law, necessary for legal claims, required for an active service, or otherwise permitted by applicable law.

15. Privacy Requests and Complaints

Privacy-related questions, requests, objections, or complaints may be sent to privacy@kzen.ph. Please provide enough information to identify the request and, where applicable, the relevant account, client, job order, or record. We may request reasonable proof of identity or authority before releasing or changing personal information.

You may also exercise your rights or lodge a complaint with the National Privacy Commission in accordance with its procedures.

16. Children and Minors

The Portal is primarily intended for business and professional transactions. We do not knowingly design the Portal to collect personal information from children for unrelated purposes. Where a minor's information is legitimately required for a legal, regulatory, or service purpose, it should be submitted only by an authorized parent, guardian, representative, or other person with lawful authority, as applicable.

17. Automated Processing and Profiling

The Portal may use automated technical processes for authentication, security, fraud prevention, filtering, sorting, reporting, notifications, and other operational functions. We do not state that every automated process constitutes a decision that produces legal or similarly significant effects. Where applicable law grants rights concerning automated processing or profiling, those rights will be respected subject to lawful exceptions.

18. Changes to This Privacy Policy

We may update this Policy when our services, technology, processing activities, legal obligations, or security practices change. The version and effective date at the top of this page identify the current published version. Material changes will be communicated where required by law.

19. Contact Information

Personal Information Controller / Privacy Contact: Kzen PH Group, Inc.
Privacy email: privacy@kzen.ph
Portal: portal.kzen.ph

This public contact is intended for privacy inquiries and data-subject requests. Where a formal Data Protection Officer is designated, the Company may provide the applicable DPO contact through the same channel or through another published notice.