Privacy Policy
1. Scope and roles
This policy covers the REDTECH One Supplier Hub: the public site, the accreditation process, and the Supplier Portal. It explains what personal information is collected, why, who it reaches, and what you can ask us to do about it.
Two organizations handle information here, and the distinction matters for your rights. REDTECH DYNAMICS SOLUTIONS CORP. owns and operates the platform. Each Accrediting Partner is a separate organization that decides, for its own purposes, whether to accredit your company. When you submit an application, that partner determines how the information in it is used for their accreditation decision, and we process it on their documented instructions as part of operating the platform.
In practical terms: ask us about the platform, and ask the Accrediting Partner about their decision and their own use of your information.
2. What we collect
Most of what we hold is business information about an organization. Some of it is personal information about identifiable people.
About your organization
- Registered business name, trade name, legal structure and registration details
- Tax Identification Number, tax classification and withholding tax attributes
- Business permit, government registrations, licences and certifications
- Addresses: principal office, registered, BIR registered, warehouses and branches
- Bank accounts used to receive payment
- Products, services, delivery capability, commercial terms and business references
- Responses to the risk assessment and compliance declarations
About people
- Names, positions, departments, email addresses and telephone numbers of the representatives you nominate
- Names and contact details of the people you give as business references
- For portal users: username, password (stored only as a cryptographic hash), sign-in history and notification preferences
- The name, position, IP address and browser details recorded when an application is submitted, as the electronic confirmation of that submission
Collected automatically
- IP address, browser and operating system details on requests we record
- Session identifiers needed to keep you signed in
- Dates and times of actions you take in the platform
We do not ask for sensitive personal information as defined by the Data Privacy Act, and you should not include any in free-text fields or uploaded documents unless an Accrediting Partner has specifically required it.
3. Why we process it
- To operate the accreditation process and route your application to the partner you named
- To let the Procurement Department of that partner evaluate your application
- To create and maintain the supplier record that follows from an approval
- To create and secure user accounts for the representatives you nominate
- To send notifications about your application and your account
- To keep the audit records that make decisions traceable and defensible
- To detect and investigate misuse of the platform
- To meet record-keeping obligations under Philippine tax, accounting and procurement rules
We do not sell personal information, and we do not use it for advertising.
4. Lawful basis
Under the Data Privacy Act of 2012 (Republic Act No. 10173), we rely on:
- Consent, which you give through the Declaration, Authority, Consent, Waiver and Data Privacy Notice before any accreditation information is collected. We record the version you accepted and when.
- Contract, where processing is necessary to take steps at your request before entering a business relationship, or to operate one that exists.
- Legal obligation, where retention or disclosure is required by law.
- Legitimate interests of the platform and the Accrediting Partner in securing the service, preventing fraud, and keeping defensible records, balanced against your rights.
5. Who it is shared with
| Recipient | What they receive |
|---|---|
| The Accrediting Partner you named | Your whole application, your documents, and the supplier record that follows from an approval. |
| Other Accrediting Partners | Nothing. A partner sees only applications submitted to it. Another partner's assessment, remarks and records are never available to them. |
| Other suppliers | Nothing. No supplier can see another supplier's application, documents or records. |
| REDTECH DYNAMICS SOLUTIONS CORP. | Access for platform administration, support and security investigation. Centralised technical administration is not unrestricted access to a client's business information. |
| SAVVYCORE GLOBAL INC. | Implementation and training support. No unrestricted access to client data without the express authorization of the client or REDTECH. |
| Service providers | Hosting and email delivery, limited to what the service requires and bound by confidentiality obligations. |
| Authorities | Where disclosure is required by law or lawful order. |
6. Documents you upload
Documents are stored privately. They are not placed in any publicly reachable location and cannot be retrieved by guessing an address: every download is served by the application after it has verified that the requester is either your own organization or an authorised reviewer of the partner you applied to.
Each view, download, upload and replacement is recorded with the person, the time and the originating address. Replacing a document keeps the previous version rather than destroying it, so the history of what was submitted remains intact.
7. Logs and audit records
Significant actions generate an audit record: who acted, what they did, which record it affected, the status before and after, the time, and the originating address and browser. These records are what make an accreditation decision traceable, and they are protected against modification and deletion.
Passwords, authentication tokens and full bank account numbers are never written to audit records.
8. Cookies
The hub currently uses strictly necessary cookies only. See the Cookie Policy for what they are, and Cookie settings to review or change your choice.
9. How long we keep it
| Record | Retention |
|---|---|
| Unsubmitted applications | 12 days from the most recent save, restarting on each save, then removed. |
| Submitted applications and decisions | Retained for the life of the supplier relationship and afterwards as required for audit, tax and accounting purposes. |
| Supplier records and documents | Retained while the accreditation exists and afterwards under the applicable retention schedule. |
| Audit and security records | Retained under the platform retention schedule. Operational records are generally kept five years and financial and security records ten years; a legal hold suspends disposal. |
| User accounts | Disabled rather than deleted, so historical records keep a valid actor. |
10. Security
The platform applies organizational and technical measures including:
- Passwords stored only as cryptographic hashes, never in a recoverable form
- Role-based access control enforced on every request, not only in the interface
- Isolation between Accrediting Partners enforced in the application and in database queries
- Private document storage with authorisation checked on every retrieval
- Protection against cross-site request forgery, cross-site scripting and injection
- Rate limiting on sign-in, password reset and other sensitive endpoints
- Session regeneration on sign-in and invalidation on sign-out
- Audit logging of significant actions
No system can be guaranteed secure, and we do not claim otherwise. These measures reduce risk; they do not eliminate it. If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected individuals as the Data Privacy Act requires.
11. Your rights
Under the Data Privacy Act of 2012 you have the right to:
- Be informed about how your personal information is processed
- Access the personal information held about you
- Have inaccurate or incomplete information corrected
- Object to processing, and withdraw a consent you have given
- Have information erased or blocked in the circumstances the law allows
- Be indemnified for damage caused by inaccurate, incomplete or unlawfully obtained information
- Obtain a copy of information you provided in a commonly used electronic format
- Complain to the National Privacy Commission
Some of these rights have limits. Where a record must be retained for audit, tax or accounting purposes, erasure may not be available, and withdrawing consent does not undo processing already carried out. If your request concerns an Accrediting Partner's own use of your information, we will direct you to that partner.
12. Children
The Supplier Hub is a business platform intended for authorised representatives of organizations. It is not directed at children, and we do not knowingly collect information from them.
13. Changes
When this policy changes, the version is updated and the new version is published here. Each consent is recorded against the version shown at the time it was given, so an earlier acceptance remains distinguishable from a later one.
14. Contact
Write to support@redtechph.com, marking your message for the attention of the Data Protection Officer.
You may also complain to the National Privacy Commission of the Philippines.