This notice explains how the Customer handles personal information about you: what is held, why, who can see it, how long it is kept, and what you can ask for.
It covers tenants and guests, the people living with them, staff and contractors, and visitors recorded at the gate.
the Customer decides what is collected and why, and is therefore the controller of it (the personal information controller, under the Data Privacy Act of 2012, Republic Act 10173). The software is operated on its behalf by Web and Cloud Innovation Ltd, of 30/1 Kenilworth Court, Sir Augustus Bartolo Street, Ta' Xbiex XBX 1093, Malta, which acts only on the Customer's instructions and is the processor. Where the General Data Protection Regulation (EU) 2016/679 applies, the same two roles apply under that name.
1What Is Collected
If you are a tenant or a guest — your name and contact details; your unit and the dates of your tenancy; who lives with you, where you told us; your identification document and the details printed on it; your billing details and payment history; the charges raised against your unit; documents you upload; photographs of the unit and of anything reported as damaged or broken; your vehicle and its plate, where you gave it; and, when you use the portal, the time, device and network address of your sign-ins.
If you work here — everything the employment requires: your contract and its terms, your pay, your statutory contributions and the identifiers that go with them, your attendance and shifts, your reviews, any disciplinary matter, the papers you have signed, and your emergency contact.
If you sign a document — the signature you drew, the name you typed, the time, the device, the network address, and, only where your browser asked you and you allowed it, one reading of your location. The electronic signature consent explains this in full.
If you come through the gate — the fact and time of your visit, who you came to see, and your vehicle where there is one.
2Why It Is Collected
To prepare and perform your lease or your employment; to bill you, to receive payment, and to keep accounts; to run the property day to day — cleaning, maintenance, deliveries, access; to reach you about your tenancy or your work; to keep the building and the people in it safe; and to meet obligations under tax, labour, tenancy and data protection law.
Nothing is collected that is not needed for one of those purposes.
3The Lawful Basis
Depending on what is being processed, the basis is: the performance of a contract with you (your lease, your employment); compliance with a legal obligation (tax, labour and reporting rules); the legitimate interests of the Customer in running and protecting the property, balanced against your interests; and, for the things the law does not permit us to do without asking — a precise location reading, a document sent for automated reading where you object to it — your consent, which you may withdraw.
Where consent is the basis, refusing it never affects your tenancy or your employment, and you will be told what the alternative is.
4Who Sees It
The people who run the property, and only as far as their work needs. Access is by named account, capabilities are granted by role, and every time a document is opened it is written into an audit log.
The processor named above, which operates the software, under the contract described in its Data Processing Agreement.
The outside services listed in the Sub-processor list: the company hosting the server, the offsite backup folder, the service that reads an uploaded document to copy its printed details, and your mail provider when a message is sent to you.
Government agencies and courts where the law requires disclosure, and professional advisers under a duty of confidence.
Nobody else. Your information is never sold, and never shared for anyone's marketing.
5Where It Is Kept, And How It Is Protected
On a server operated for the Customer, in a database that belongs to this business alone.
Uploaded identification documents, receipts and signed papers are encrypted at rest with a key held apart from the offsite backups. Traffic is encrypted in transit. Accounts can carry an authenticator-app second factor, and administrators can be required to. The security page describes all of it in detail.
Backups are taken nightly and a copy is kept offsite under restricted access.
6How Long It Is Kept
For the life of the tenancy or the employment, and afterwards only for as long as tax, accounting, labour and legal rules require — then it is deleted.
An identification document is kept for as long as the tenancy or employment it supports, unless the law requires longer.
Sign-in and audit records are kept for as long as they are useful for security and for answering a question about who did what.
7Automated Reading Of Documents
An uploaded document may be read once by an automated service, solely to copy its printed details into your record so that nobody has to type them.
It is not used to train any model, no decision about you is made by that reading, and a person can always check and correct what it produced. It can be switched off, and the details typed by hand instead.
There is no automated decision-making that produces a legal effect concerning you.
8Your Rights
You may ask to see the information held about you, and to be given a copy.
You may ask for it to be corrected if it is wrong, or completed if it is missing something.
You may ask for it to be deleted, or for its use to be restricted, where the law allows — bearing in mind that some records must be kept for a fixed period whatever anybody would prefer.
You may object to processing that rests on legitimate interests, and withdraw a consent you gave.
You may ask for the information you provided to be given to you, or to somebody else, in a portable form.
You may complain — to the Customer first, and then to the National Privacy Commission of the Philippines, or, where the General Data Protection Regulation applies, to the Information and Data Protection Commissioner of Malta or the supervisory authority where you live.
Asking costs nothing, and an answer is due within the period the law sets: thirty (30) days under the GDPR, and fifteen (15) days under RA 10173, which may be extended where a request is complex, in which case you will be told.
9Cookies And What Your Browser Stores
One cookie is set when you sign in. It holds a session identifier and nothing else, it cannot be read by scripts, it is not sent to another site, and it is deleted when you sign out or when the session expires.
There is no advertising cookie, no analytics cookie and no third-party tracker anywhere in this system.
The typefaces the pages use are delivered by Google's font service, which necessarily sees the network address of the device asking for them. Nothing else about you is sent with the request.
If you install the pages as an app on your phone, your browser keeps a copy of the interface itself so that it opens without a network. That copy holds no personal information.
10If Something Goes Wrong
If personal information is lost or disclosed in a way that puts you at real risk, you will be told, and so will the National Privacy Commission — within seventy-two (72) hours of the breach being known, as the law requires. The same period applies under the GDPR.
11Who To Ask
privacy@premises.ph
For anything concerning the software rather than the business that uses it: Web and Cloud Innovation Ltd, 30/1 Kenilworth Court, Sir Augustus Bartolo Street, Ta' Xbiex XBX 1093, Malta, legal@premises.ph