Data Privacy Policy

1. Statutory Open Data Exemption (Section 4(e), RA 10173)

Torre Index indexes public contract awards, winning bidder designations, procuring entity registries, and approved budgets pursuant to the explicit statutory exemption under Section 4(e) of the Data Privacy Act of 2012 (Republic Act No. 10173), which establishes that the Act does not apply to:

Under Republic Act No. 12009 (New Government Procurement Act), open contracting records are matters of public interest and constitutional right to information.

2. Client-Side Zero-Custody Mode Architecture

When utilizing the Statutory GPPB Envelope 1 Bid Packager or Contractor Private Vault:

• RAM-Only Computation: Contractor financial metrics (Current Assets, Current Liabilities, Ongoing Works) and professional license credentials (PRC numbers) are processed dynamically in volatile browser/server memory for arithmetic evaluation.
• Zero Persistent Custody: No contractor balance sheets, tax returns, or audited financial statements are archived or sold. Once the evaluation payload is assembled, session artifacts are dropped from active memory.

3. Telemetry & Congestion Anonymization (RA 10667 Compliant)

Platform interaction telemetry (such as contractor interest counts on live notices) is strictly aggregated using one-way cryptographic SHA-256 session salts. Torre Index does not expose individual contractor identities or bidding intentions to competing estimators, guaranteeing immunity under PCC horizontal coordination guidelines.

4. Payment Information Security

All payment card numbers, GCash details, and financial account identifiers are processed directly by our licensed Bangko Sentral ng Pilipinas (BSP)-regulated payment provider (PayMongo). Torre Index never collects, sees, or stores raw payment credentials on its servers.

5. Rights of Data Subjects & Right of Reply

Pursuant to Sections 16 and 18 of RA 10173, registered users and commercial contractors maintain the right to:

• Right to Rectification: Formally dispute, correct, or clarify any clerical attribution error in indexed awards via our Compliance Desk (/api/report-discrepancy).
• Right to Erasure: Delete private vault items, watchlists, or alert subscriptions immediately from user settings.
• Data Protection Officer (DPO): For institutional inquiries, reach our compliance team at [email protected].