Privacy Policy

The personal information controller responsible for this website is:

Gentoo Media Inc.
Triq id-Dragunara
St. Julian's STJ 3148
Malta

Gentoo Media Inc. determines the purposes and means of processing your personal data collected through this website. Although Gentoo Media Inc. is incorporated in Malta, this Privacy Policy applies in full to all users in the Philippines pursuant to Section 6 of RA 10173, which extends the Act's reach to entities that process personal information about Philippine citizens or residents, regardless of where the controller is established.

Our Group Data Protection Officer is responsible for overseeing compliance with RA 10173 and can be contacted for any privacy-related queries, requests, or concerns:

Edward Fenech Adami
Group Data Protection Officer — Gentoo Media Inc.
Email: [email protected]

We aim to acknowledge all privacy requests within five (5) business days and to resolve them within thirty (30) days of receipt, in accordance with NPC Advisory No. 2017-01.

We collect the following categories of personal data when you use this website:

We do not collect sensitive personal information as defined in Section 3(l) of RA 10173 (e.g. health data, government IDs, financial account details). If any such data is inadvertently received, it will be deleted without processing.

Under Section 12 of RA 10173, processing of personal information is lawful when at least one of the statutory criteria applies. The table below sets out the purpose of each processing activity and the corresponding legal basis:

Where processing is based on legitimate interest (Sec. 12(f)), we have assessed that our interests are not overridden by your fundamental rights under the Philippine Constitution and RA 10173. You have the right to object to any such processing — see Section 9 below.

We engage the following categories of personal information processors under Section 14 of RA 10173. Each is bound by a Data Processing Agreement or equivalent contractual safeguard requiring them to protect personal data to at least the standard required by this Act:

We do not sell personal data to third parties. Processors are engaged solely to perform services on our behalf and are prohibited from using your data for their own purposes.

As Gentoo Media Inc. is headquartered in Malta (European Union) and engages processors in various countries, your personal data may be transferred to and processed in jurisdictions outside the Philippines, including:

• Malta / European Union — our data controller entity; the EU operates under the General Data Protection Regulation (GDPR), which provides an equivalent level of protection
• United States — certain analytics providers, advertising platforms, and cloud infrastructure providers are US-based
• Other jurisdictions — as determined by individual processor locations

Pursuant to Section 21 of RA 10173 (Principle of Accountability for Transfer of Personal Information), we remain accountable for any personal data we transfer internationally. We ensure that all cross-border transfers are governed by:

• Contractual data processing agreements incorporating the substantive obligations of RA 10173;
• Standard contractual clauses or equivalent contractual safeguards; and
• Technical and organisational security measures appropriate to the nature of the data transferred.

If you would like details of the specific safeguards in place for a particular transfer, please contact our Data Protection Officer at [email protected].

Cookies are small text files placed on your device when you visit our website. We use the following categories of cookies:

How We Obtain Consent

When you first visit our website, a cookie consent banner is displayed. Non-essential cookies are only activated after you click "Accept" or make a granular selection through "Manage Preferences". Your consent choices are recorded and respected on subsequent visits.

You may change your cookie preferences at any time by clicking the "Cookie Settings" link in the site footer, or by adjusting your browser settings to block or delete cookies. Note that disabling certain cookies may affect site functionality.

Affiliate tracking cookies are placed when you click a link to one of our operator partners. These store a referral identifier (not personally identifiable on its own) so that the operator can credit our referral if you register. These cookies typically persist for 30 days.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law, in accordance with Section 11(e) of RA 10173:

At the end of each retention period, data is securely deleted or anonymised so that individuals can no longer be identified from it.

As a data subject under the Data Privacy Act of 2012, you are entitled to the following rights. To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will verify your identity before processing your request and will respond within thirty (30) days.

Right to Be Informed (Sec. 16(b))

You have the right to be informed whether your personal data is being, or has been, collected and processed. This Privacy Policy constitutes our primary transparency disclosure.

Right to Access (Sec. 16(c))

You may request a copy of the personal data we hold about you, including the sources from which it was obtained, who it has been shared with, and the reasons for any disclosures. A reasonable administrative fee may apply for excessive or repetitive requests.

Right to Rectification (Sec. 16(d))

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. We will update the data and, where applicable, notify any third parties to whom it was previously disclosed.

Right to Erasure / Blocking (Sec. 16(e))

You may request that we delete, block, or destroy your personal data if it is: incomplete, outdated, false, unlawfully obtained, no longer necessary for the purpose it was collected, or used for an unauthorised purpose. Certain retention obligations (e.g. legal, contractual, or regulatory) may prevent immediate erasure.

Right to Object (Sec. 16 & Sec. 12(f))

You have the right to object to processing based on legitimate interests, including profiling and direct marketing. Where you object to direct marketing, processing for that purpose will cease immediately.

Right to Data Portability (Sec. 18)

Where your data is processed by electronic means in a structured, commonly-used format, you may request a machine-readable copy of your personal data, or ask us to transmit it directly to another controller where technically feasible.

Right to Damages (Sec. 16(f))

You have the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal information.

How to Exercise Your Rights

Submit your request by email to [email protected] with the subject line "RA 10173 Data Subject Request". Please include:

• Your full name and contact details
• The specific right you wish to exercise
• Sufficient information to locate your data in our systems
• A copy of a valid government-issued ID (for identity verification)

In accordance with Section 20 of RA 10173, we implement reasonable and appropriate organisational, physical, and technical measures to protect your personal data against accidental or unlawful destruction, alteration, disclosure, or any other unlawful processing. These measures include:

• TLS/HTTPS encryption for all data in transit
• Encryption at rest for databases containing personal data
• Access controls and role-based permissions limiting data access to authorised personnel only
• Regular security assessments and vulnerability monitoring
• Documented information security policies and staff training
• Data processing agreements with all third-party processors

In the event of a security breach involving your personal data that is likely to give rise to a real risk of harm, we will notify the National Privacy Commission and affected data subjects as required by Section 20(f) of RA 10173 within the timeframes prescribed by NPC Circular 16-03.

Step 1 — Contact Us First

If you have a concern about how we handle your personal data, please contact our Data Protection Officer in the first instance. We will investigate your concern promptly and aim to resolve it within thirty (30) days:

Edward Fenech Adami — Group Data Protection Officer
Email: [email protected]

Step 2 — Escalate to the National Privacy Commission

If you are not satisfied with our response, or if you believe we are processing your personal data in breach of RA 10173, you have the right to lodge a formal complaint with the Philippine National Privacy Commission (NPC):

National Privacy Commission
5th Floor, Delegation Building, PICC Complex
Roxas Boulevard, Pasay City, Metro Manila, Philippines

📞 Trunkline: +63 2 5322 1322
📧 Complaints: [email protected]
📧 General Enquiries: [email protected]
🌐 Website: privacy.gov.ph

The NPC requires complaints to be filed using its official Complaint-Affidavit Form, notarised, and submitted in person, by courier, or by email to [email protected]. Full instructions and the downloadable form are available at privacy.gov.ph/filing-a-complaint/.

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory guidance. When we make material changes, we will update the "Last updated" date at the top of this page. For significant changes, we may also notify you by email (if you are a newsletter subscriber) or by a prominent notice on the website.

We encourage you to review this Privacy Policy periodically. Continued use of this website after any changes have been posted constitutes your acknowledgement of the updated policy.