Privacy Notice

Who is responsible

The Personal Information Controller for this website is Nexthread Information Technology Services, trading as Nexthread Solutions, a sole proprietorship registered with the Department of Trade and Industry under Business Name No. 4501133 (National).

Contact details for the Data Protection Officer are on the contact page.

What we collect, and why

When you send an enquiry

We receive the name, organization, email address and message you type into the form. We use them to reply to you, to understand what you are asking for, and — if it goes that far — to prepare a proposal.

Lawful basis: steps taken at your request prior to entering into a contract, and our legitimate interest in responding to enquiries about our services.

Retention: enquiries that do not lead to an engagement are deleted after twelve months. Enquiries that do lead to an engagement are retained under the engagement's own retention terms.

When you browse

This site is a set of static pages. It does not use advertising cookies, analytics cookies, tracking pixels, session recording or any form of visitor profiling. Your color-mode preference is stored in your browser's local storage so the site remembers whether you prefer light or dark; that value never leaves your device and is not personal data we can see.

Our hosting provider records standard server logs, which may include IP addresses, for security and reliability purposes.

Free tools

The registration self-check on this site runs entirely in your browser. Your answers are never transmitted to us and are not stored anywhere we can reach.

Who we share it with

We do not sell personal data, and we do not disclose it for anyone else's marketing.

We use service providers to host this website and to carry our email. Where a provider processes personal data on our behalf, they do so as a Personal Information Processor under a written agreement meeting the requirements of the Implementing Rules and Regulations, Rule X.

We disclose personal data to a regulator, court or law enforcement body only where we are legally required to.

Where it is processed

Some service providers operate outside the Philippines. There is no Philippine adequacy regime, so where a transfer occurs we remain accountable for the data under Section 21 of the Data Privacy Act and rely on contractual protections with the provider.

How we protect it

Access is limited to those who need it. Data in transit is encrypted. Devices are encrypted and access-controlled. We maintain a breach response procedure and will notify the National Privacy Commission and affected individuals where a breach meets the notification criteria, within 72 hours of knowledge or reasonable belief.

Your rights

Under the Data Privacy Act you have the right to be informed, to object, to access, to rectification, to erasure or blocking, to damages, to data portability, and to lodge a complaint.

To exercise any of them, see Your data rights. We respond within the periods set by the NPC, and there is no charge for a reasonable request.

You may also complain directly to the National Privacy Commission at privacy.gov.ph.

Changes

We review this notice at least annually and whenever a new NPC issuance affects it. The version and review date are recorded at the top of this page.