NPC Compliance & Data Privacy Act of 2012
Fruitask is committed to full compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and the regulations enforced by the National Privacy Commission (NPC).
This page explains how Fruitask operates as a Personal Information Processor (PIP) and/or Personal Information Controller (PIC) under the DPA and our commitment to protecting the privacy rights of Philippine residents and all users.
Understanding the Data Privacy Act of 2012
The Data Privacy Act of 2012 protects personal information by regulating how it is collected, processed, stored, and shared. The National Privacy Commission (NPC) is the independent authority responsible for overseeing compliance with this law.
DPA Core Principles
- ✓ Lawfulness of Processing
- ✓ Purpose Limitation
- ✓ Data Minimization
- ✓ Accuracy & Completeness
- ✓ Storage Limitation
- ✓ Integrity & Confidentiality
Individual Rights
- ✓ Right to Be Informed
- ✓ Right to Object
- ✓ Right to Access
- ✓ Right to Rectification
- ✓ Right to Erasure
- ✓ Right to Data Portability
Fruitask as PIC/PIP
Fruitask operates in dual capacity under the DPA:
Personal Information Controller (PIC)
Fruitask acts as a PIC when determining the purposes, methods, and extent of processing of your personal information, including:
- Account authentication and registration
- Service delivery and platform operation
- Customer support and communications
- Analytics and platform improvement
- Security and fraud prevention
Personal Information Processor (PIP)
Fruitask acts as a PIP when processing personal information on behalf of our customers (who are PICs). We only process data as instructed by our customers through:
- Data Processing Agreements (DPAs)
- Customer workspace settings and controls
- Data retention policies as specified by customer
- Access controls and permission management
Note: Fruitask's Personal Information Processor/Controller registration with the National Privacy Commission is currently in progress. We are committed to completing this registration in compliance with NPC requirements.
How Fruitask Complies with DPA 2012
1. Lawful Processing
We process personal information only for legitimate purposes:
- Consent: Explicit consent from data subjects (users)
- Contract: Processing necessary to provide our services
- Legal Obligation: Compliance with Philippine laws
- Legitimate Business Purpose: Security, fraud prevention, platform improvement
2. Data Minimization & Purpose Limitation
We collect only what is necessary and use data only for stated purposes:
- Name and email for account management
- Profile information you voluntarily provide
- Workspace data you create and store
- Technical data necessary for platform operation
3. Security & Integrity
We implement technical and organizational measures to protect personal information:
- HTTPS/TLS encryption for data in transit
- bcrypt password hashing
- Role-based access control
- Two-factor authentication (2FA) support
- Regular security audits
- Incident response procedures
4. Transparency & Individual Rights
We respect all rights provided under the DPA:
- Clear Privacy Policy available to all users
- Right to be informed about data collection
- Right to object to processing
- Right to access your data
- Right to request correction (rectification)
- Right to request deletion (erasure)
- Right to data portability
5. Accountability & Record Keeping
We maintain documentation of our data processing activities:
- Data Processing Register
- Audit logs and access records
- Data Processing Agreements with processors
- Privacy Impact Assessments
Your Rights as a Data Subject
Under the Data Privacy Act of 2012, you have the following rights:
Right to Be Informed
You have the right to be informed when your personal information is being collected and how it will be used. Our Privacy Policy provides complete information.
Right to Object
You can object to the processing of your personal information for certain purposes (e.g., marketing, profiling). Contact us to exercise this right.
Right of Access
You can request a copy of the personal information we hold about you. We will provide this within 15 days of your request in a readable format.
Right to Rectification
You can request correction of inaccurate or incomplete personal information. You can also update your profile directly in account settings.
Right to Erasure (Right to Be Forgotten)
You can request deletion of your personal data, including your account. We will process this request within 15 days, except where we have legal obligations to retain data.
Right to Data Portability
You can request your personal data in a structured, machine-readable format to transfer to another service. We support CSV and JSON export.
How to Exercise Your Rights
To exercise any of these rights, contact us at privacy@fruitask.com with your request and sufficient information for us to identify you. We will respond within 15 days. You also have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe your rights have been violated.
Data Retention Period
In compliance with DPA 2012's storage limitation principle, we retain personal information only as long as necessary:
| Data Type | Retention Period |
|---|---|
| Active Account Data | While account is active |
| User Workspace Content | Until deletion by user; 30 days after soft deletion |
| Account Deletion Request | Processed within 15 days |
| Audit Logs | 1 year (for security & compliance) |
| Tax/Legal Records | 5 years (as required by law) |
| Password Reset Tokens | 24 hours |
| Email Verification Tokens | Until email is verified (max 7 days) |
Subprocessors & Data Partners
Fruitask uses the following subprocessors under Data Processing Agreements (DPA) that comply with DPA 2012:
Infrastructure
Hostinger (Europe) — hosting and infrastructure management
Database
MongoDB — data storage and management
Email Services
Hostinger SMTP / Fruitask SMTP — transactional emails
Analytics
Google Analytics (anonymized) — usage statistics
Payment Processing
Paddle payment processing
SSO / Authentication
Google & GitHub OAuth — optional social login
All subprocessors are contractually bound to process personal information only as instructed and maintain appropriate security measures. Contact us for a detailed list of current subprocessors and their DPAs.
Data Breach Notification
In compliance with DPA 2012 Section 18, if we experience a personal data breach, we will:
- Notify affected data subjects without unreasonable delay
- Describe the nature of the breach and personal data affected
- Explain the potential harm and consequences
- Provide information on measures taken to address the breach
- Notify the National Privacy Commission as required by law
Contact & NPC Complaints
Privacy Inquiries
Email: privacy@fruitask.com
Response Time: Within 15 days
Data Breach & Security Concerns
Email: security@fruitask.com
Response Time: Within 24 hours
National Privacy Commission (NPC)
If you believe your rights under the Data Privacy Act of 2012 have been violated, you may file a complaint with the National Privacy Commission:
Website: www.privacy.gov.ph
Email: office@privacy.gov.ph
Address: 4th Floor, Donghae Building, 32 San Marcelino St., Malate, Manila
NPC Registration Status
Fruitask is in the process of registering with the National Privacy Commission (NPC) as a Personal Information Controller and Personal Information Processor. We are committed to completing this registration in full compliance with all NPC requirements and DPA 2012 guidelines.
In the interim, we are maintaining the highest standards of data privacy and security compliance. This page provides complete transparency about our data handling practices and your rights under Philippine privacy law.
Updates to This Policy
We may update this NPC Compliance page to reflect changes in our practices or legal requirements. Significant changes will be communicated to users via email or platform notification.