Privacy Policy

Depending on the type of service you will require or the type of engagement you will have with us, the Data we process may include, but are not limited to: your name, age, address, contact number, email address, gender, birthdate, company name, signature, image of your ID, information on your ID, images that may contain your personal data, your image or photograph, image or photograph of your delivery address, information about your health, education, or employment, government-issued data, financial information, documents that contain personal data, and others. Should you choose not to provide any of the above Data, 2GO may not be able to accommodate your request or perform its Services.

Depending on your engagement with 2GO, Data may be collected in any of the following instances:

• during face-to-face transactions
• when accomplishing an online or paper form
• when sending us an email
• when directly providing information on a 2GO system
• during phone, email, or online transactions
• when visiting any site protected by a CCTV system

The DPA defines “processing” as “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.’

2GO processes your Data for various authorized or legitimate purposes such as, but not limited to:

• meeting our obligations to our customers who avail of any 2GO product or service
• complying with our legal obligations
• complying with legal, government, and regulatory requirements
• assisting our customers
• addressing inquiries
• sending advisories
• improving the quality of our products, services, and processes
• employment-related processes
• engaging the services of consultants, service providers, vendors, suppliers or other third parties;;
• processing agent, partner, or other applications
• customer engagement programs
• data analytics and profiling to improve our product and service offerings
• sending marketing communications
• ensuring the safety of our premises
• other legitimate commercial and business purposes

Processing of Data is performed by authorized employees, representatives, affiliates and appointed third-party service providers for authorized or legitimate purposes. Data are processed in secure areas in the Philippines and in secure offshore locations. Depending on the transaction or engagement, 2GO uses Data “as is” and without further processing. When necessary, 2GO may subject the Data to additional processing before these are used for authorized or legitimate purposes.

Prior to using automated decision-making as the sole basis of any decision that may affect your rights and freedoms, 2GO shall first inform you about the details of the automated process and seek your consent thereafter.

2GO understands that there will always be risks involved when processing Data whether on paper, in storage, or in transit. Examples of risks include data loss, unauthorized access and/or disclosure, alteration, or others that may be accidental or intentional as in the case of hacking and the like. While risks cannot be totally prevented, 2GO has in place organizational, physical, and technological security measures to mitigate these risks. Security measures include, among others, ensuring that paper records are stored in secure office and warehouse facilities, ensuring that access to data is under strict confidentiality, implementing a system access management policy, having firewall, encrypting data in transit, and scanning systems for vulnerabilities. Automated access such as Application Programming Interface (APIs) and Single Sign-in are secured via encryption and Secure Sockets Layer (SSL).

2GO will not share your Data with third parties unless necessary for the purposes stated in this Privacy Statement and, whenever applicable, only after your consent is obtained. Such third parties may include 2GO’s subsidiaries, affiliates, business partners, service providers, contractors, and any similar entities. Any Data shared with such third parties shall be covered by the appropriate privacy agreement to ensure that adequate safeguards are in place.

We may disclose your Data when required by law or court order, or as requested by government or law enforcement authorities, or in good faith that disclosure is otherwise necessary or advisable including and without limitation to protect the rights or properties of 2GO. This also applies when we have reason to believe that disclosing your Data is necessary to identify, contact or bring legal action against someone who may be causing interference with 2GO’s rights or properties, whether intentionally or otherwise, or when anyone else could be harmed by such activities.

Our website is intended only for persons who are at least eighteen (18) years old (“Minors”). We neither offer products or services to, nor knowingly collect personal data of, Minors without legal basis. Should we learn that we were provided with personal data of Minors for reasons that are not in accordance with the Data Privacy Act, we will delete the same from our database unless there is legal basis for retaining and processing such personal data (e.g. contract entered into and/or consent given by the parent or legal guardian of the Minors on their behalf). If you are a Minor, please do not provide any personal data to us, such as your name, age, gender, email address, contact information and the like.

2GO retains your Data only for the period required in relation to the Purposes in this Privacy Statement, the applicable privacy notices provided by 2GO, and/or for the period allowed under the applicable laws and regulations, including but not limited to the DPA and its IRR. Depending on the type of information, retention periods may vary. Transaction information are retained in 2GO systems for pre-defined periods or are archived, and financial records are retained for 10 years. Employment information are retained in varying periods depending on the nature of the document. Paper records containing personal data beyond retention are destroyed via chemical and mechanical means (i.e. shredding, pulping) and data on electronic systems are sanitized to ensure that information can no longer be associated to individuals.

You are responsible for the accuracy of any Data you provide to 2GO. You are likewise responsible for the consequences of failing to provide accurate, correct, and updated Data to 2GO.

Your rights under the DPA include the right:

• to be informed that your data is being, will be, or has been processed
• to reasonable access to your data
• to request the correction of your Data as long as the request is not vexatious or otherwise unreasonable
• to request the erasure of your Data upon discovery and with substantial proof that the Data is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or are no longer necessary for the purposes for which it was collected
• to be indemnified for damages sustained for the unauthorized use of your Data
• to lodge a complaint to the Data Protection Officer or the NPC
• to the portability of your Data

For inquiries regarding this Privacy Statement, or to exercise your rights under the DPA, please send a written communication addressed to our Data Protection Officer as follows:

2GO may amend this Privacy Statement from time to time by posting an updated version on our website. We encourage you to visit this site frequently to stay informed about how 2GO processes your data.

August 24, 2022