Privacy Statement – Vendor and Consultant

Privacy Statement for vendors, suppliers or contractors, and consultants

We value your data

We value the privacy of all our individual vendors, suppliers, contractors and consultants as well as the officers, employees, attorneys-in-fact, and authorized representatives of our corporate service providers. We request for the personal data of sole proprietors and other individual persons representing our corporate contractors mostly for purposes of accreditation and official correspondences. At the point of data collection, we give them an opportunity to review our Privacy Statement and sign acknowledgment forms to signify that they have understood how we uphold their rights as data subjects and how we secure copies of their personal data that are in our possession.

Collecting your personal data

We collect your personal data in the course of, or incidental to the conduct of, our business with you. This data includes any other information that you voluntarily provide for a legitimate purpose declared at the point of collection, as well as information about you that we received from third parties and other sources where the disclosure was subject to a consent that you gave separately, as the result of a legal requirement, or any legitimate purpose made known to you.

Transparency in processing. Whenever we collect personal data, we provide just-in-time privacy notices and consent forms, when applicable, at the point of collection. 

Data minimization. The data we collect is only as much as is relevant and necessary to meet our processing purpose. We collect this personal data in the course of or incidental to our business with you. 

The data we collect. Generally, we will collect the following information:

1. Information you submit to MERALCO in your application for accreditation, use of supply chain application system, and/or processing of payments, such as your name, tax identification number, government-issued identification information, address, contact details, educational attainment, work experience and banking information.
2. Information we collect and maintain about you and your employees in relation to the preparation, execution, or fulfilment of your contract with us, and to the development of a single contact directory that may guide MERALCO, its subsidiaries and affiliates in coordinating with your representatives for upcoming business partnerships or engagements.
3. Information we collect and maintain about you in relation to your Certified by Meralco (CBM) membership, such as when you apply for accreditation and participate in the CBM selection process on its website.
4. Information that your employees submit to have access to or perform your services or deliver your products within the premises of the Company.

Purpose of Processing 

We store, process, and/or analyze the personal data collected for legitimate purposes related to, or incidental to, our business operations, including maintaining safety and security within the company premises.

Specifically, we may store, process, and analyze your personal data for the following and any other legitimate purposes related to the fulfillment thereof:

1. To establish our business relationship or consultancy engagement. We process your personal data to evaluate your application for accreditation or as basis for our engagement.
2. To conduct business with you. We process your data to enforce our legal and contractual obligations including evaluating or auditing the provision of goods and/or services you provide, and facilitating the payment of your invoices in various payment methods (i.e., Fund Transfer, Corporate Check, Outsourced Check); informing you of our requirements, programs, or advisories; referring you as a potential service provider to our customers; and responding to your questions, comments, and feedback by letter, e-mail, telephone, or other media for internal administrative purposes, such as auditing, data analysis, and database records management. Your data may also be processed to comply with statutory, legal, and regulatory requirements related to our business.
3. To maintain your account with us and establish potential business relationship with our Subsidiaries and Affiliates. We maintain and update your vendor account information and establish details of your authorized contact persons for the goods and/or services you provide. We may also process your data for procurement synergy initiatives, including referring you as a potential vendor to our subsidiaries and affiliates and maintaining a directory as a single point of reference in the pursuit of these initiatives.

How do we process your personal data

1. Data Subject – vendors, suppliers or contractors, and consultants
2. As needed / as applicable
3. When applicable, data sharing or outsourced processes are covered by DSA, NDA, and/or OAs

Note: Privacy Notice is process specific while the Privacy Statement is a public commitment to data privacy

Read the diagram as text

The diagram follows the data subject, Meralco, its subsidiary and third parties through the personal-data lifecycle.

1. Collect. Meralco publishes the Privacy Statement and prepares the Privacy Notice and Consent/Acknowledgment Form. You read the privacy notice, statement, notice terms and conditions, and provide consent if you agree (as needed / as applicable). You provide personal information through forms, accreditation requirements, consent form, etc. Meralco receives the accomplished forms.
2. Store. Meralco properly secures and stores the personal information.
3. Use. Meralco carries out the following processes in the order shown:
   1. Vendor Accreditation Process
   2. Procurement Process
   3. Account Setup Process
   4. Payment Process
   5. End of Contract Process and Account Deactivation
4. Transfer.
   • A subsidiary requests vendors/suppliers. Meralco provides information.
   • Government may request personal data for audit, examination, or investigation (as needed / as applicable). Meralco provides information.
   • Contractors carry out processing a request/service in fulfillment of the contract (as needed / as applicable). Meralco provides information.
   The provision of information is subject to note 3 above.
5. Dispose. Meralco conducts the retention and disposal procedure. The diagram routes the final use process and the provision of information to this procedure, then ends.

Sharing your personal data

Unless you provide specific consent or in instances allowed under law, we do not share your personal data with our business partners or other third parties for their own commercial purposes or benefit. 

Additionally, we do not use your personal data to enable third-party targeted advertisements that are unrelated to our business.

When data is shared, especially across borders and jurisdictions, we ensure your data is protected through appropriate Data Sharing Agreements.

In the processing of your personal information, we may have to disclose your data to parties acting as personal information processors, which may fall across these broad categories: 

• Authorized Representatives and Consultants. We ensure that our authorized representatives and consultants adhere to the same standards as our employees and trainees and require them to commit to observing the company’s privacy policies. We require our Authorized Representatives and Consultants to sign a Non-Disclosure Agreement (NDA) to ensure that they process your data confidentially in a manner consistent with the purpose of their employment or engagement.
• Contractors and Business Partners, including Auditors. We require our contractors, subsidiaries, and business partners to secure and keep your data confidential through appropriate contractual and operational controls. We do not allow our contractors, subsidiaries, or business partners acting as personal information processors to disclose or share your data with others or use it for their own purposes. We take punitive or legal action in cases of proven misconduct.

In the processing of your personal information, such personal information may nonetheless be disclosed when legally required or when necessary to complete our commitment to provide services to you. 

These entities to whom your personal data may be disclosed include:

• Government entities. Your information may also be disclosed to government entities pursuant to and in compliance with applicable laws and regulations, subpoena or court order.

Keeping your data secure

We are committed to ensure the integrity, confidentiality, availability, and security of your information. We implement reasonable organizational, physical, and technical security measures in collecting, processing, transmitting, storing, and disposing your personal data such as using secure servers, firewalls and security controls and ensuring regular conduct of audit and testing of our security protocols. We only store your personal data in Meralco-owned and/or controlled data storage solutions.

For an enhanced online experience, our services are available through compatible devices, such as laptops, PCs, tablets, and mobile phones. For your added security, we recommend that you install anti-virus software on any such device before accessing the internet.

You are responsible for the security of your information once it reaches you or your representative in any medium, including but not limited to written correspondences, bills, emails, system applications, and on-line accounts. 

You should take appropriate measures to ensure that any medium or device you use to monitor or manage your account is secure and not accessible to anyone without permission.

Retaining your personal data

We keep your personal data only for as long as necessary to fulfill the declared, specified, and legitimate purposes provided above, or until the processing relevant to those purposes has been completed or terminated. We may also retain your data for the establishment, exercise, or defense of legal claims, or for other business purposes that align with standards established or approved by regulatory agencies governing Meralco.

For further information on our retention rules for documents with personal data, you may refer to our DP FAQ 2021-01 Retention of Documents Containing Personal Data .

Thereafter, your personal data shall be disposed of or discarded in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other party or the public.

Your data subject rights

If you wish to request a copy of your personal data, or have it corrected or deleted, or to exercise your rights as data subject, you may reach out to us through our Data Privacy Office (DPO). Meralco DPO will promptly respond to your request or questions and also review any feedback that you may have about our Privacy Statement.

We uphold your right to be informed whenever we provide a link to or a copy of this Statement prior to collecting your personal data or as soon as reasonably practicable after collection. In processing your data for the specific purposes we discussed in this Statement and those that may be related to such purposes, we shall endeavor to prepare privacy notices that remind you how we collect, use, disclose, and process your personal data in the manner described in this Statement, including our procedures relating to cookies, IP addresses and log files. As to any other purpose that you may not find or cannot infer from this Statement, we shall take all reasonable efforts to obtain your permission through a separate consent form that may either require your signature or contain a button that you could click as proof of your consent.

About this Statement

From time to time, we may update this Statement to comply with applicable laws, rules, and regulations; to reflect any changes to the foregoing; to align with industry practices; or for other legitimate purposes.

You may view past versions of the Statement below.