Privacy Policy

October 12 clarification: Profiles are private by default, except where the candidate has separately opted into public website promotion. Client-facing profile consent and public website promotion are separate choices.

October 6 update: Newly issued contractor password reset links now expire after 72 hours. Earlier links retain their original expiry.

October 5 update: This version adds the Consent and Data Retention Standard, including separate marketing choices and evidence, record retention, legal holds, secure disposal and historical agreement acceptance. Publication does not amend a previously accepted agreement; material changes follow the applicable notice, consent and amendment procedures.

1. Who We Are

VirtuPinoy is a trade or business name used by VirtuPinoy Virtual Assistance Services, a sole proprietorship registered in the Philippines under Registration number 8366326, with registered business address at Pulong Santa Cruz, Santa Rosa City, Laguna 4026, Philippines (collectively, “VirtuPinoy,” “we,” “us,” or “our”).

VirtuPinoy operates a website and online platform that supports outsourcing, recruitment, contractor matching, client account management, contractor profile management, contracts, invoicing, payment coordination, onboarding, support, and related services.

For personal data that we determine the purpose and means of processing, VirtuPinoy generally acts as a personal information controller. For personal data processed only on a client's documented instructions, VirtuPinoy may act as a personal information processor. The applicable role may depend on the activity and is addressed further in client agreements and the Data Processing Addendum.

2. Contact Details

3. Scope of This Policy

This Privacy Policy applies to personal data processed through:

• virtupinoy.com and its subdomains;
• the Client, Contractor, Staff, and Admin portals;
• client and contractor applications, profiles, interviews, meetings, and onboarding;
• contracts, invoices, payment confirmations, payout records, and support tickets;
• Tracker time recording and engagement work diaries, including activity records and work evidence where the applicable engagement uses those features;
• email, video meetings, telephone calls, forms, and other communications with VirtuPinoy;
• candidate matching, scoring, ranking, recommendations, and related human review;
• business operations, compliance, security, audit, and fraud-prevention activities.

This policy does not govern a third party's independent processing on its own website or service. Third-party payment providers, video-meeting services, client systems, and other providers may have their own privacy terms.

4. Personal Data We May Collect

We collect only data reasonably necessary for legitimate and disclosed purposes. The categories below depend on the user's role and interaction with VirtuPinoy.

4.1 Website visitors

We may collect:

• IP address and approximate location derived from it;
• browser, device, operating system, language, and screen information;
• pages viewed, links clicked, referral source, and session information;
• authentication, security, error, and access logs;
• cookie and preference information;
• messages sent through contact, support, or inquiry forms.

4.2 Client representatives and prospective clients

We may collect:

• full name, business email, business telephone, title, role, and authority;
• company name, address, website, industry, registration information, size, and business description;
• identity or authority-verification information where reasonably necessary;
• hiring requirements, job descriptions, budgets, schedules, time zones, tools, responsibilities, and candidate preferences;
• candidate shortlists, interview requests, evaluations, selection decisions, and meeting notes;
• contracts, statements of work, signatures, approvals, invoices, payment references, proof of payment, receipts, and disputes;
• portal activity, account settings, notifications, support tickets, and communications;
• fraud, security, compliance, and audit information.

4.3 Applicants and contractors

We may collect:

• full legal name and approved display name;
• contact information, location, time zone, and availability;
• professional photo, biography, title, skills, languages, tools, platforms, and industry experience;
• education, certifications, training, work history, references, achievements, portfolio items, resume, and introductory video;
• interview recordings or notes where appropriate notice and permission are provided;
• equipment, internet speed, backup internet, backup power, and work-readiness information;
• identity and eligibility documents, tax information, and other records reasonably required for verification, contracting, payment, or legal compliance;
• contract terms, assignment details, schedules, performance information, attendance or availability records, time records where applicable, and support tickets; for engagements using Tracker, session and manual time entries, start and end times, active and idle durations, task descriptions and notes, application names and window titles, mouse click and keystroke counts, activity percentages, billable status, and approval history; screenshots, images or other work evidence where captured and made available for that engagement;
• payout instructions, payment references, receipts, and payout history;
• background or reference-check information only where lawful, proportionate, disclosed, and separately authorized where required;
• profile-change requests, approval history, client feedback, complaints, investigations, and offboarding information;
• job application content, including cover letters, qualifications, availability, professional title, application status, submission dates and related interview requests; portal interview messages, participant information and message timestamps;
• portal activity, device, authentication, access, and security logs.

4.4 Staff, administrators, and service providers

We may collect:

• identity, contact, role, access permissions, training, and acknowledgment records;
• work activity, audit logs, system access, support actions, approvals, and operational communications;
• payment, contract, security, incident, and compliance information relevant to the relationship.

4.5 Sensitive personal information

Certain records may qualify as sensitive personal information under applicable law, including education records, government-issued identifiers, health or accommodation information, tax information, and information relating to legal proceedings. We limit such collection, apply additional safeguards, and process it only where a lawful basis exists.

Please do not upload health information, government identifiers, criminal records, bank credentials, or other sensitive data unless VirtuPinoy specifically requests it through an approved secure process.

5. How We Collect Personal Data

We may collect personal data:

• directly from you through forms, portal entries, uploads, contracts, interviews, messages, and meetings;
• from an authorized company representative, recruiter, reference, client, contractor, or service provider;
• from publicly available professional sources where lawful and relevant;
• automatically through logs, cookies, authentication, and security tools;
• from payment providers, banks, email systems, ticketing tools, file-storage providers, and other vendors involved in a transaction or support request;
• from client systems when VirtuPinoy personnel perform agreed services on the client's behalf.

Where another person provides your information, that person must have the authority and lawful basis to do so.

6. Purposes and Legal Bases

Depending on the activity and applicable law, we may process personal data based on consent, steps requested before entering a contract, performance of a contract, compliance with legal obligations, protection of lawful rights, legitimate interests that do not override individual rights, or another basis permitted by law.

We may process data to:

6.1 Operate accounts and portals

• create, verify, approve, secure, and administer accounts;
• authenticate users, reset passwords, manage sessions, and prevent unauthorized access;
• provide role-based portal features, notifications, help content, and support.

Typical basis: contract or pre-contract steps, legitimate interests, legal obligation, and security interests.

6.2 Provide recruitment and outsourcing services

• understand client hiring needs;
• receive and evaluate applications;
• publish approved open job information, receive applications to those jobs, share relevant application information with the client responsible for the job, and enable authorized interview messages;
• create and approve contractor profiles;
• identify, score, rank, shortlist, compare, and recommend candidates;
• coordinate interviews, meetings, offers, contracting, onboarding, assignments, and replacements;
• administer ongoing engagements and service quality.

Typical basis: contract or pre-contract steps, legitimate interests, and consent where required for specific profile-display or background-check activities.

Approved open job listings may be visible on the public website, including the role, responsibilities, requirements, schedule and advertised budget or arrangement. Private client account details and payment credentials are not part of a public job listing. A job application is not a public applicant profile.

6.3 Display approved contractor profiles

• present approved professional information to approved clients;
• enable clients to review resumes, portfolios, videos, skills, experience, availability, and matching information;
• allow contractors to preview and request changes to their client-facing profiles.

Typical basis: separate contractor consent and legitimate recruitment interests. The Contractor Profile Display Consent provides further details.

Profiles are private by default, except where the candidate has separately opted into public website promotion. A separate, specific opt-in may allow VirtuPinoy to feature only the approved professional information covered by that choice, such as an approved display name, professional photo, summary, skills or experience, on its public website. Public promotional content may be viewed by anyone and indexed by search engines.

Account creation, applying for a job, approval of a client-facing profile, profile display consent and newsletter consent do not by themselves authorize public website promotion. Full resumes, private contact details, identity documents, financial information and internal records remain private and are not included in public promotional profiles. Candidates may withdraw their separate public promotion choice or request removal of content controlled by VirtuPinoy by contacting privacy@virtupinoy.com. Search engines or other third parties may retain copies outside VirtuPinoy's control.

6.4 Contracts, billing, payments, and payouts

• prepare and execute agreements and statements of work;
• issue invoices and receipts;
• provide manual prepaid invoice instructions and, when enabled, hosted payment links;
• verify proof of payment, reconcile payments, handle disputes, and maintain accounting records;
• calculate and process contractor payouts and respond to payout inquiries.

Typical basis: contract, legal obligation, legitimate interests, and establishment or defense of legal claims.

For engagements using Tracker, we use relevant work diary records to review recorded time, approve billable hours, calculate invoices and contractor payouts, and investigate billing or service disputes. Collection must be necessary and proportionate to the disclosed engagement purpose. Before collection, the applicable engagement notice must explain which features are enabled, how collection occurs, the lawful basis for each activity, authorized recipients, retention and how to raise a concern.

6.5 Communications and support

• respond to inquiries and complaints;
• create and manage support tickets;
• send service, security, account, meeting, contract, payment, and payout notices;
• maintain communication history and service-quality records.

Typical basis: contract, legitimate interests, legal obligation, and consent for optional marketing.

6.6 Safety, security, fraud prevention, and compliance

• monitor for unauthorized access, abuse, scraping, circumvention, fraud, malware, and security incidents;
• maintain audit trails and investigate suspected violations;
• comply with lawful government, regulatory, tax, judicial, and law-enforcement requirements;
• protect the rights, property, systems, users, and business of VirtuPinoy and others.

Typical basis: legal obligation, legitimate interests, and establishment or defense of legal claims.

6.7 Improvement and analytics

• diagnose errors and performance issues;
• understand feature usage and improve navigation, accessibility, and service quality;
• conduct aggregated or de-identified analysis;
• evaluate matching quality, operational efficiency, and support outcomes.

Typical basis: legitimate interests and consent where non-essential cookies or similar technologies require it.

6.8 Marketing

• send newsletters, educational content, offers, or event invitations where permitted;
• measure marketing performance.

Typical basis: affirmative consent for optional newsletters and marketing. Marketing preferences are separate from essential service communications and may be changed at any time. VirtuPinoy chooses an explicit opt-in approach for these communications; this does not mean that consent is the only lawful basis for every form of marketing under all applicable laws.

7. Candidate Matching, Profiling, and Automated Processing

VirtuPinoy may use rule-based processing, automated analysis, artificial intelligence, or similar tools to compare client job requirements with information contained in approved contractor profiles.

The system may consider categories such as:

• required and preferred skills;
• relevant experience and seniority;
• industry experience;
• tools and platforms;
• schedule, availability, time zone, and start date;
• education and certifications;
• language and communication indicators;
• equipment and work readiness;
• approved soft-skill and role-fit indicators.

The system may generate a match percentage, category, strengths, missing requirements, or suggested ranking. These outputs are decision-support tools only. They do not guarantee suitability, availability, performance, employment, engagement, or hiring success. VirtuPinoy does not intend the score alone to make a final decision that significantly affects a contractor. Human review, profile correction, interviews, client judgment, contractor availability, verification, contracts, and payment steps remain part of the process.

Applicants and contractors may request access to or correction of the data used in their profile and may raise concerns about a score or recommendation by contacting privacy@virtupinoy.com or support@virtupinoy.com. Clients may request manual recruitment assistance instead of relying on automated matching.

Additional information will be presented when automated matching materially affects the applicable service.

8. When We Share Personal Data

We may disclose personal data only as reasonably necessary and subject to confidentiality, access, security, and contractual safeguards.

8.1 Approved clients

Approved clients may receive approved client-facing contractor information for legitimate evaluation and engagement purposes. They do not receive private contact details, government identifiers, bank information, home addresses, background-check documents, or internal staff notes unless a separate lawful and necessary process applies.

When an eligible applicant or contractor submits an application to a specific job, we provide the client responsible for that job with the relevant application information, including the approved display name, professional title, cover letter, qualifications, availability, status and submission date. This can occur even if the applicant does not have a published contractor profile. Authorized interview participants can see their portal message history. Application submission does not itself give consent to general profile publication or optional marketing. Recruitment and service records may also be processed by authorized VirtuPinoy personnel and providers for the purposes described in this policy, subject to access controls.

8.2 Contractors

After an engagement is properly activated, a contractor may receive client and assignment information reasonably necessary to perform services. Contractors do not receive client payment credentials, internal financial information, other contractors' data, or information beyond the scope of their assignment.

Work diary access

Work diary information for an enabled engagement is available to its authorized client, the assigned contractor and authorized VirtuPinoy administrative or finance staff according to their permissions. Tracker and authorized infrastructure providers may process the records to provide the service. Records are not public contractor profile content and are not made available to unrelated clients or contractors. Screenshots and notes may contain client or third party information, which must be handled under the applicable confidentiality and data protection terms.

8.3 Service providers and subprocessors

We may use providers for:

• website hosting and infrastructure;
• authentication and security;
• email, notifications, and support ticketing;
• file storage, backup, and document processing;
• video meetings and scheduling;
• analytics and performance monitoring;
• artificial intelligence or matching assistance;
• electronic signatures;
• accounting, invoicing, payment, and payout coordination;
• professional legal, tax, audit, and compliance services.

Providers may process information only for authorized purposes and under appropriate contractual and security obligations. A current list or category list may be provided at support@virtupinoy.com.

8.4 Payment providers and financial institutions

Clients receive the payment methods available for their authenticated invoice, which may include manual payment instructions and hosted PayPal checkout for eligible USD invoices. Other providers or currencies are available only where expressly offered. A hosted provider independently processes payment information under its own terms and privacy notice. VirtuPinoy may receive transaction references, sender information, amount, currency, status, proof, and related details needed to verify and reconcile payment. We do not ask users to provide payment-provider passwords or online-banking credentials. Payment credentials entered on a hosted provider page are handled by that provider.

8.5 Professional advisers, authorities, and legal recipients

We may disclose data to advisers, insurers, auditors, courts, regulators, government agencies, law enforcement, or other recipients where required or permitted by law, necessary to establish or defend claims, or necessary to protect rights and safety.

8.6 Business transactions

If VirtuPinoy undergoes a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, relevant data may be disclosed subject to confidentiality, lawful purpose, notice, and appropriate safeguards.

9. Cross-Border Processing

VirtuPinoy operates from the Philippines and serves international clients. Personal data may therefore be accessed, stored, or processed in the Philippines and in countries where clients or service providers operate.

Where data is transferred domestically or internationally, VirtuPinoy will use contractual, organizational, and technical measures designed to provide a comparable and appropriate level of protection. Depending on the applicable law, measures may include data-processing agreements, confidentiality commitments, transfer clauses, access controls, encryption, subprocessor reviews, and client-approved instructions.

International clients remain responsible for identifying any country-specific transfer requirements that apply to client-controlled data and for providing lawful instructions. The Data Processing Addendum may be used to allocate responsibilities.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the stated purposes, contractual and operational needs, legal obligations, dispute resolution, security, fraud prevention, and recordkeeping.

The following periods apply to the specified records under VirtuPinoy’s control, unless longer retention is lawfully necessary for a documented legal, contractual, investigation, dispute, audit or compliance requirement. We retain Tracker information only for as long as reasonably necessary for time verification, contractor payment, client billing, dispute handling, audit, compliance and legitimate business purposes. These are VirtuPinoy retention standards, not statutory Tracker-specific periods.

Approved hours and necessary billing summaries are financial records and follow the financial retention period; this does not extend retention of all raw activity records or images. For financial records, the applicable contract period ends at the end of the period the record supports; a later retention period required by law continues to apply.

Application records, interview messages, support records and other categories not assigned a fixed period above will be retained according to their disclosed purpose, application or engagement status, applicable legal obligations and unresolved claims. Marketing consent evidence, suppression records and agreement acceptance evidence will be retained only as reasonably necessary to demonstrate a valid choice or agreement, respect withdrawals, meet legal obligations or resolve claims. The account profile period does not automatically determine the retention of these separate records. Contact privacy@virtupinoy.com for the applicable period or criteria.

Normal deletion schedules will be suspended for relevant information reasonably required for an active client or contractor dispute, payment or chargeback investigation, fraud or security investigation, government inquiry, tax audit, or legal claim or proceeding. Relevant records may be retained until the matter is finally resolved and any required legal retention period has expired. Holds will be limited to necessary records, with a recorded reason, restricted access and review. When the hold ends, records whose ordinary retention period has expired will be securely disposed of.

When the applicable retention period expires and no lawful hold or longer retention requirement applies, VirtuPinoy will securely delete, destroy or anonymize personal information so that it can no longer reasonably identify the individual. VirtuPinoy will not retain identifiable personal information indefinitely merely because it might be useful in the future. Restricted storage during a lawful hold is not a substitute for disposal after the hold ends.

For personal data processed only on a client’s instructions, the applicable Data Processing Addendum, lawful instructions and legal requirements govern return, deletion and retention. This schedule does not authorize expanded monitoring, new data categories, additional sharing or camera recording. Any future optional camera feature requires prior notice of its purpose, scope, lawful basis, recipients and retention, and any separate consent required by law. Existing profile display or newsletter consent does not authorize that feature.

11. Security Measures

VirtuPinoy uses reasonable and appropriate organizational, physical, and technical measures proportionate to the nature and risk of processing. Measures may include:

• role-based and least-privilege access;
• unique accounts, password controls, and multi-factor authentication where available;
• secure transmission, encryption where appropriate, and protected storage;
• logging, monitoring, vulnerability management, backups, and recovery processes;
• separation of Test and Production data and credentials;
• secure file-access controls and expiring links;
• staff confidentiality obligations and privacy/security training;
• vendor and subprocessor due diligence;
• incident-response and breach-notification procedures;
• periodic review, privacy impact assessments, and access recertification.

No system can be guaranteed completely secure. Users must protect credentials, use secure devices and networks, report suspected compromise promptly, and avoid sending sensitive information through unapproved channels.

Contractor password reset links expire 72 hours after issue. Client and staff password reset links, and initial password setup links, expire after 30 minutes. These links are single use. Issuing a replacement invalidates earlier unused links for the same account and purpose. If a link expires, request a new one through the approved account recovery process.

12. Data Subject Rights

Subject to applicable law and lawful limitations, individuals may have the right to:

• be informed about processing;
• access personal data and relevant processing information;
• correct inaccurate or incomplete data;
• object to certain processing, including direct marketing and, where applicable, profiling;
• withdraw consent for future processing where consent is the basis;
• request deletion or blocking where legally available;
• request data portability where applicable;
• seek compensation for damage caused by unlawful processing where provided by law;
• lodge a complaint with the National Privacy Commission or another competent authority.

To exercise a right, contact privacy@virtupinoy.com. We may request information reasonably necessary to verify identity, authority, and the scope of the request. We will respond within the period required by applicable law or, where no fixed period applies, within a reasonable time.

A request may be limited or denied where permitted by law, including where necessary to protect another person's rights, comply with law, retain evidence, secure systems, or establish or defend legal claims. We will explain the basis where required.

13. Profile Corrections and Withdrawal from Client Display

Contractors may use the portal or contact support to review their client-facing profile and submit corrections. All contractor-proposed profile changes require staff review and approval before publication. Until approval, the last approved profile will remain visible.

A contractor may withdraw consent for future client-facing display by contacting privacy@virtupinoy.com. Withdrawal does not affect processing already lawfully completed and may not require deletion of records that VirtuPinoy must retain for contractual, security, legal, or dispute purposes. Withdrawal may reduce or end eligibility to be presented for opportunities that require profile display.

14. Marketing Choices

Service and security messages are necessary for account and engagement administration and are not marketing. Optional newsletters, promotional emails, talent updates, client offers, educational content and similar marketing communications will be sent only after a voluntary affirmative opt-in. Marketing consent is separate from account creation, applications, hiring, contracts, payments and other transactional communications. Marketing checkboxes will not be pre-selected. Users may withdraw that choice through an unsubscribe link, an available portal preference, or by contacting support. After unsubscribe or withdrawal, VirtuPinoy will stop sending marketing communications to that individual. We may retain only a minimal suppression record needed to respect the preference and prevent inadvertent re-enrollment.

Publishing a contractor profile, being available for work, or receiving account or engagement messages does not subscribe a person to optional newsletters. An affirmative newsletter choice is required separately from profile display consent. Refusing or withdrawing marketing consent does not prevent necessary communications about accounts, applications, contracts, payments, security, support requests or other transactional matters. Authorized email campaign providers may process recipient contact details, subscription preferences and delivery information for that purpose and must receive applicable withdrawals.

When an individual voluntarily subscribes, VirtuPinoy will maintain a record of marketing consent. Where technically available, this will include the email address, name, date and time consent was provided, source of consent, version of the consent language shown, consent status, date of withdrawal or unsubscribe, method or source of withdrawal, and relevant audit information reasonably necessary to demonstrate consent. Sources may include a website signup, client or contractor portal, event registration or campaign form. Consent evidence and suppression records are limited to the purposes and retention criteria in section 10.

Example optional checkbox:

☐ I would like to receive news, updates, educational content, promotions, and other marketing communications from VirtuPinoy. I understand that I may unsubscribe at any time.

15. Cookies and Similar Technologies

VirtuPinoy may use cookies, local storage, pixels, and similar technologies for authentication, security, preferences, performance, analytics, and—only where deployed and permitted—marketing. Necessary technologies support login and platform operation. Non-essential analytics will activate only after the visitor makes an affirmative analytics choice through the website preference mechanism.

Until a separate Cookie Policy is published following a Production technical scan, questions about the current cookie and analytics inventory may be sent to privacy@virtupinoy.com.

16. Children and Minors

VirtuPinoy's services are intended for business representatives and individuals legally able to enter the relevant agreements. Applicants must be at least 18 years of age. We do not knowingly create contractor profiles for children. If we learn that data was collected from a child without an appropriate basis or authorization, we will take reasonable steps to investigate and delete or restrict it.

17. Third-Party Links and Client Systems

The platform may link to payment providers, video-meeting tools, client systems, and other third-party services. VirtuPinoy is not responsible for an independent third party's privacy practices. Users should review the third party's policies before providing data.

When contractors access a client's systems, the client may independently determine processing purposes and provide privacy instructions. The contractor must follow the client agreement, VirtuPinoy policies, and applicable law.

18. Personal Data Breaches and Incidents

VirtuPinoy maintains procedures for identifying, containing, investigating, documenting, remediating, and notifying relevant parties about security incidents. Where notification is required, VirtuPinoy will notify the competent authority, affected data subjects, clients, or other parties within the applicable legal period and with the required information.

Users must report suspected loss, disclosure, malware, account compromise, misdirected email, unauthorized access, or other incident immediately to privacy@virtupinoy.com.

19. Changes to This Policy

We may update this policy to reflect changes in services, technology, law, or operations. The updated version will show a version number and effective date. Existing users will be notified of material changes through the website, portal, email or another appropriate method. Publication does not itself establish acceptance of materially different terms or consent to new processing. Where a new consent is legally required, we will request it separately before the affected processing begins. Users will be given an appropriate opportunity to object or withdraw consent where applicable.

We will preserve historical notice versions and, where an agreement or consent is accepted electronically, maintain the user ID, agreement or consent name, version number, effective date, date and time accepted, acceptance method and version accepted. The record will link to a permanent copy or immutable reference to the accepted version. An IP address may be included only if collected and appropriate. A later update will not overwrite the historical version originally accepted. Acknowledging a privacy notice does not by itself supply consent for every processing activity.

For material changes to contractual rights, responsibilities, payments or monitoring, VirtuPinoy may require review and affirmative acceptance of the applicable updated agreement before continuing the affected feature or service. Separate agreements remain subject to their amendment procedures. Minor administrative, formatting, contact or clarification changes that do not alter rights or processing may be communicated without renewed acceptance unless applicable law requires otherwise. Appropriate notice will nevertheless be provided when a privacy notice or processing activity materially changes.

20. Complaints

Please contact privacy@virtupinoy.com for privacy concerns and support@virtupinoy.com for general complaints. We will create or provide a ticket or reference number where practical, investigate the issue, and communicate the outcome or next steps.

Individuals may also contact the National Privacy Commission or another competent regulator. Nothing in this policy limits rights that cannot lawfully be waived.