Privacy Policy

Introduction

This Privacy Policy describes how the Armed Forces of the Philippines Pension and Gratuity Management Center (AFPPGMC) ("we," "us," "our," or "the Company") collects, uses, shares, and protects your personal information when you use our Heroes mobile application and related services (collectively, the "Service").

Company Information:

• Name: Armed Forces of the Philippines Pension and Gratuity Management Center (AFPPGMC)

• Address: Camp Aguinaldo, Quezon City, Metro Manila, Philippines

• Contact: isu.pgmc@gmail.com

• Data Protection Officer: MAJ Israel Soquerata

This policy complies with:

• Republic Act No. 10173 (Data Privacy Act of 2012)

• National Privacy Commission (NPC) Implementing Rules and Regulations

• Relevant international data protection standards

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy and our Terms and Conditions. If you do not agree, please do not use the Service.

1. Definitions

The following terms have specific meanings in this Privacy Policy:

Account: A unique account created for You to access our Service.

Affiliate: An entity that controls, is controlled by, or is under common control with the Company.

Application: Refers to Heroes, the mobile application provided by the Company.

Company: Refers to the Armed Forces of the Philippines Pension and Gratuity Management Center (AFPPGMC), located at Camp Aguinaldo, Quezon City, Metro Manila, Philippines.

Country: Refers to the Republic of the Philippines.

Device: Any device that can access the Service, such as a smartphone or tablet.

Personal Data: Information that relates to an identified or identifiable individual.

Service: Refers to the Application and related services.

Service Provider: Any third party that processes data on behalf of the Company.

Usage Data: Data collected automatically, such as IP address and device information.

You: The individual accessing or using the Service, or the legal entity on whose behalf such individual is accessing or using the Service.

2. Personal Data We Collect

We collect the following types of personal data to provide pension management services:

2.1 Identity Information

• AFP Serial Number

• First name and last name

• Date of birth

• Branch of Service (Army, Navy, Air Force, Philippine Constabulary)

• Date of Retirement

2.2 Contact Information

• Email address

• Phone number

• Mailing address (Street, City, Province, ZIP/Postal code)

• Geographic location data (GPS coordinates, city, region)

2.3 Pension-Related Information

• Pensioner type (Principal or Beneficiary)

• Beneficiary type and relationship (if applicable)

• Principal pensioner information (for beneficiary applications)

• Officer status

2.4 Account Credentials

• Password (stored securely using encryption)

2.5 Usage Data

• IP address

• Device type and operating system

• App version and usage patterns

• Timestamps of actions performed

• Diagnostic and crash data

2.6 Media and Files

• Photos and documents (with your permission, for form submissions)

• Camera and microphone access (for document scanning and video verification)

2.7 Location Data

• GPS coordinates (latitude and longitude)

• City, municipality, and province

• Approximate location based on IP address

• Location timestamp (when location was captured)

2.8 Biometric Authentication Data

• Fingerprint (Touch ID) and/or facial recognition (Face ID) data used for authentication

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide, maintain, and improve our pension management services

• To verify your identity and eligibility for pension benefits

• To manage your account and provide customer support

• To process pension claims and applications

• To communicate with you via email, SMS, push notifications, or other means

• To provide important updates about your pension status

• To detect, prevent, and address technical issues and fraud

• To comply with legal obligations and government regulations

• To analyze usage patterns and improve the Service

• To fulfill contractual obligations related to pension administration

• To verify your current location when submitting forms and applications

• To detect and prevent fraudulent submissions from unauthorized locations

• To maintain accurate records of where forms were submitted for audit purposes

• To provide location-based services and support

• To provide optional biometric authentication for faster and more secure access to your account

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

Legal Obligation: Processing is required to comply with Philippine laws and regulations governing pension administration.

Consent: You have given explicit consent for specific processing activities (e.g., camera access for proof-of-life recording).

Location Access: You provide explicit permission through your device settings to access your location when submitting forms through the Application.

Legitimate Interest: Processing is necessary for our legitimate interests in providing secure, efficient services and preventing fraud.

Biometric Authentication Consent: Biometric login is optional and enabled only with your explicit consent through your device settings and Application preferences.

5. Data Retention

We retain your personal data for different periods depending on the type of information:

Active Accounts: For the duration of your account plus 7 years after closure, as required by Philippine government record-keeping regulations.

Pension Records: Indefinitely, as required by law for government pension systems.

Usage Data: Up to 2 years for analytics and service improvement purposes.

Support Communications: Up to 5 years from the date of your last interaction.

Location Data: 7 years from the date of form submission, as required by government record-keeping regulations.

Biometric Data: The Application does not store biometric data. All biometric information remains on your device and is managed entirely by your device's operating system. Disabling biometric login or uninstalling the Application removes any associated authentication tokens.

6. Your Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights:

Right to Access: You can request a copy of your personal data we hold.

Right to Rectification: You can request correction of inaccurate or incomplete data.

Right to Erasure: You can request deletion of your data, subject to legal retention requirements.

Right to Object: You can object to processing of your data for specific purposes.

Right to Data Portability: You can request your data in a structured, machine-readable format.

Right to Withdraw Consent: You can withdraw consent at any time where processing is based on consent.

Right to Lodge a Complaint: You can file a complaint with the National Privacy Commission of the Philippines.

To exercise any of these rights, please contact us at isu.pgmc@gmail.com.

7. Sharing Your Personal Data

We may share your personal data in the following circumstances:

Government Agencies: We may share data with Philippine government agencies as required for pension administration and legal compliance.

Service Providers: We may share data with trusted third-party service providers (e.g., cloud hosting, email services) who are contractually obligated to protect your data.

Legal Requirements: We may disclose data to comply with legal obligations, court orders, or government requests.

Protection of Rights: We may disclose data to protect the rights, property, and safety of the Company, users, and the public.

We do not sell your personal data to third parties.

8. Security of Your Personal Data

We implement robust security measures to protect your personal data:

• Industry-standard encryption for data in transit (TLS/SSL) and at rest (AES-256)

• Secure password hashing using bcrypt or similar algorithms

• Multi-factor authentication options

• Regular security audits and vulnerability assessments

• Access controls and role-based permissions for staff

• Secure servers hosted in compliance with Philippine data protection laws

• Regular backups with encrypted storage

• Employee training on data protection and privacy

• Location data is encrypted and stored securely with access limited to authorized personnel only

• Biometric authentication is handled exclusively by your device's secure hardware. The Application only receives a pass/fail result from the device where raw biometric data is never accessible to, transmitted to, or stored by AFPPGMC.

However, no method of transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

9. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the National Privacy Commission within 72 hours of discovery

• Notify affected individuals without undue delay

• Provide information about the nature of the breach and measures taken

10. Children's Privacy

Our Service is primarily intended for adults aged 18 and older. However, we recognize that minor children may be eligible beneficiaries under Philippine pension laws (e.g., children of deceased pensioners).

Collection of Children's Data

When collecting personal data from or about children under 18 years of age, we:

• Require a parent or legal guardian to create and manage the account on behalf of the minor beneficiary

• Obtain verifiable parental consent before collecting, using, or disclosing personal information of children under 13 years old

• Collect only information necessary for pension administration and legal compliance

• Apply additional security measures to protect children's data

• When collecting location data for minor beneficiaries, we require parental or guardian consent and only collect location at the time of form submission.

Parental Rights: Parents or legal guardians have the right to review, update, or delete their child's personal information at any time by contacting us at isu.pgmc@gmail.com.

If we discover that we have collected personal information from a child under 13 without proper parental consent (except as required by law), we will take steps to delete that information as soon as possible.

11. Location Data and Permissions

11.1 How We Use Location Data

The Application requires access to your device location when submitting forms to:

• Verify the geographic location of form submissions

• Prevent fraudulent applications

• Comply with record-keeping requirements for government transactions

• Enhance security and accuracy of submissions

11.2 When Location is Collected

Location data is collected only when you:

• Submit a form through the Application

• Explicitly grant location permission when prompted

We do not track your location continuously or in the background.

11.3 Location Permission

You can control location access through your device settings at any time. Denying location access may limit your ability to submit certain forms through the Application.

To manage location permissions:

• Android: Settings > Apps > Heroes > Permissions > Location

• iOS: Settings > Privacy & Security > Location Services > Heroes

11.4 Location Data Retention

Location data associated with form submissions is retained for 7 years in accordance with government record-keeping requirements.

12. Biometric Authentication

12.1 How Biometric Authentication Works

The Application offers optional biometric login (fingerprint or facial recognition) as a convenient and secure alternative to password entry. This feature uses your device's built-in authentication system and does not involve AFPPGMC accessing or storing your biometric data.

12.2 When Biometric Data is Used

Biometric authentication is used only when you:

• Choose to enable biometric login in the Application settings

• Attempt to log in using your device's biometric prompt

12.3 Enabling and Disabling Biometric Login

Biometric login is entirely optional. You can enable or disable it at any time:

• Android: Settings > Apps > Heroes > Permissions, or within the App under Account Settings

• iOS: Settings > Privacy & Security > Face ID & Passcode > Heroes, or within the App under Account Settings

Disabling biometric login will require you to use your password to access your account.

12.4 Biometric Data Retention

AFPPGMC does not retain any biometric data. All biometric processing occurs locally on your device. When you disable biometric login or uninstall the Application, any stored authentication tokens are removed from your device.

13. Links to Other Websites

Our Service may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies before providing any personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy in the Application

• Displaying a prominent notice in the Application

You are advised to review this Privacy Policy periodically for any changes. The "Last updated" date at the top indicates when the policy was last revised.

15. Contact Us

If you have any questions, you may contact us:

• Armed Forces of the Philippines Pension and Gratuity Management Center (AFPPGMC)

Camp Aguinaldo, Quezon City, Metro Manila, Philippines

• Through the App:

Use the “Contact Us” option found in the About Us section of the app.

• Email:

isu.pgmc@gmail.com

ncrupdating@yahoo.com

You may also file a complaint with the National Privacy Commission of the Philippines:

National Privacy Commission
5th Floor, Philippine International Convention Center (PICC)
Vicente Sotto St., Pasay City, Metro Manila
Website: www.privacy.gov.ph

16. Acceptance

By using our Service, you acknowledge that you have read and understood this Privacy Policy and agree to be bound by its terms.