Privacy Policy

This Privacy Policy (“Policy”) governs the collection, use, processing, storage, disclosure, and protection of personal data by Listahanan.ph (“Listahanan,” “we,” “us,” or “our”).

This Policy is adopted in compliance with:

• Republic Act No. 10173 (Data Privacy Act of 2012);
• Its Implementing Rules and Regulations (IRR);
• Applicable issuances of the National Privacy Commission (NPC).

This Policy applies to all Users who access or use the Platform, submit inquiries, or provide personal data through any interaction with Listahanan. By using the Platform, you acknowledge that you have read and understood this Policy.

Listahanan.ph, operated by ELEVENTECH OPC (TIN: 010-987-577-000), acts as the Personal Information Controller (PIC) with respect to personal data collected through the Platform.

Our Data Protection Officer (DPO) oversees compliance with applicable data protection laws and may be contacted for all privacy-related matters:

ELEVENTECH OPC is exempt from mandatory registration with the National Privacy Commission (NPC) as it employs fewer than 250 persons and does not process sensitive personal information as its primary business function. This Policy is nonetheless adopted in full compliance with RA 10173 and NPC issuances.

Listahanan collects personal data that is adequate, relevant, suitable, necessary, and not excessive in relation to the purposes stated in this Policy.

A. Data Provided Directly by Users

• Full name
• Email address
• Mobile or telephone number
• Location (city/province)
• Inquiry messages and preferences
• Account credentials

B. Verification Data

• Government-issued identification (treated as sensitive personal information under Section 3(l) of the Data Privacy Act and subject to heightened security controls)
• PRC license information (if applicable)
• Proof of ownership or authority documents (if applicable)

C. Automatically Collected Data

• IP address
• Browser and device type
• Operating system
• Access logs and pages viewed
• Timestamps and usage behavior

D. Cookies

We use only essential cookies strictly necessary for authentication and session management (session tokens, CSRF protection, and login state). These cookies are required for the Platform to function and do not require prior consent under applicable law. No third-party analytics, advertising, or tracking cookies are used.

Personal data is processed for the following specific purposes:

• Core Service Delivery — to enable Users to view Listings, submit inquiries, and connect with relevant Third Parties.
• Communication Facilitation — to transmit inquiries to Third Parties and relay responses.
• Platform Security and Integrity — to detect, prevent, and investigate fraud; monitor suspicious activity; and ensure system security.
• Platform Improvement — to analyze usage trends and enhance functionality and performance.
• Legal Compliance — to comply with applicable laws, regulations, and lawful orders.
• Marketing (Consent-Based) — to send promotional messages, newsletters, or updates, only upon explicit consent.

Failure to provide necessary personal data may result in inability to submit inquiries or access certain Platform features.

Processing is conducted on the following lawful bases as recognized under the Data Privacy Act:

• Consent of the Data Subject;
• Contractual necessity (to perform obligations under these Terms);
• Legitimate interests (including fraud prevention and system security);
• Compliance with legal obligations.

Processing shall adhere to the principles of transparency, legitimate purpose, and proportionality.

A. Disclosure to Third Parties on Inquiry

When a User submits an inquiry, relevant personal data is disclosed to the applicable Third Party. You acknowledge that such Third Party becomes an independent Personal Information Controller; Listahanan does not control or supervise their processing; and Listahanan shall not be liable for their actions.

B. Service Providers (Personal Information Processors)

Listahanan may engage service providers for cloud infrastructure, payment processing, and email delivery. These providers act as Personal Information Processors and are bound by contractual obligations to protect data.

C. Legal and Regulatory Disclosure

Personal data may be disclosed when required by applicable law, court order, or other lawful legal process. Listahanan will require appropriate legal process (such as a court order or written demand from a competent government authority) before disclosing personal data to law enforcement or government agencies, except where disclosure is necessary to prevent imminent risk to life or safety.

Where personal data is transferred outside the Philippines, Listahanan shall implement appropriate safeguards, enforce contractual protections, and ensure all transfers comply with applicable laws including the Data Privacy Act of 2012.

Personal data is retained only as long as necessary for the purposes stated in this Policy:

• Inquiry data: up to 24 months after last interaction;
• Account data: until account deletion or sustained inactivity;
• Payment records and Official Receipts: minimum ten (10) years as required under BIR Revenue Regulations and the National Internal Revenue Code; financial records are excluded from erasure requests to the extent required by applicable tax law;
• Access logs: retained for security and compliance purposes.

After the applicable retention period, data is securely deleted or anonymized to prevent identification.

Listahanan implements reasonable and appropriate organizational, physical, and technical safeguards to protect personal data, including access controls, encryption where applicable, and monitoring systems. No system is completely secure, and Listahanan does not guarantee the absolute security of any data.

In the event of a personal data breach, Listahanan shall:

• assess the nature and extent of the breach;
• notify the National Privacy Commission (NPC) within seventy-two (72) hours of discovery where the breach is likely to result in significant harm to Data Subjects;
• notify affected Data Subjects without undue delay where their rights or interests are at risk;
• implement corrective and containment measures.

Under the Data Privacy Act of 2012, Data Subjects have the right to:

• be informed of the processing of their personal data;
• access their personal data;
• request correction or rectification;
• object to processing;
• request erasure or blocking;
• data portability;
• withdraw consent at any time;
• file a complaint with the National Privacy Commission.

To exercise these rights, submit a request to the Data Protection Officer at dataprotection@listahanan.ph, including sufficient identification and a clear description of your request. Listahanan shall respond within fifteen (15) working days of receiving a verified request, which may be extended by an additional fifteen (15) working days for complex requests, with prior notice to the Data Subject. Data portability requests will be fulfilled in a commonly used electronic format (CSV or PDF). Note that payment records and Official Receipts are excluded from erasure requests for the retention period required by BIR regulations.

The Platform is not intended for individuals under eighteen (18) years old. Listahanan does not knowingly collect personal data from minors. If we become aware that personal data has been collected from a minor, we will take steps to delete it promptly.

Automated Processing. Listahanan does not engage in automated decision-making that produces legal or similarly significant effects.

Third-Party Links. Listahanan is not responsible for the privacy practices of third-party websites linked from the Platform.

Governing Law. This Policy is governed by Philippine law. Data Subjects may file complaints with the National Privacy Commission.

Amendments. We may update this Policy at any time. Continued use of the Platform constitutes acceptance of the revised Policy.

Contact. For privacy-related inquiries: Data Protection Officer — dataprotection@listahanan.ph. For general inquiries: hi@listahanan.ph.