Privacy Policy
Effective November 13, 2026
This policy sets out the rules everyone at Apollos follows when handling personal information: on this website, with our clients, and inside the software we build. It puts the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules and the issuances of the National Privacy Commission into everyday practice. For what we collect on this website and why, see our Privacy Notice.
Scope
This policy covers all personal information Apollos Software Development Services (“Apollos”, “we”, “us”) handles, in any form, and applies to everyone who works with us, including employees, contractors and freelancers.
Our principles
- Transparency. People know what we collect, why, and who to contact.
- Legitimate purpose. We use information only for the purpose it was given for.
- Proportionality. We collect only what we need and keep it only as long as we need it.
Our role
As a controller. For information you give us directly, such as when you book a call, we decide how it is used. Our Privacy Notice explains this.
As a processor. When we build or run software for a client, the personal information of that client’s customers and staff belongs to the client. We handle it only on their written instructions, under our Data Processing Agreement, and never for our own purposes.
Access and use
- Only people who need personal information for their work can access it, and only the parts they need.
- Everyone with access signs a confidentiality agreement and completes privacy training when they join.
- Access is removed as soon as someone leaves or no longer needs it.
- We use test or anonymized data when building and testing software wherever we can, instead of real customer data.
Security measures
- Technical. Encrypted connections, two-step verification on every work account, strong unique passwords, regular updates, and backups for the systems we run.
- Organizational. A named Data Protection Officer, written procedures, and a yearly review of this policy.
- Physical. Work devices are locked when unattended and protected with a password or passcode. Lost or stolen devices are reported right away.
Service providers
We use a small number of trusted providers, such as Cloudflare for hosting, Resend for email delivery and Google for email and calendar. Each is bound by an agreement to protect the information. When a provider stores data outside the Philippines, we make sure it is protected to the standard the Data Privacy Act requires.
Retention and disposal
We keep personal information only as long as its purpose requires, or as long as the law requires. Inquiry and booking details are deleted two years after our last contact. Client data is returned or deleted within 30 days after a project ends, unless the client asks otherwise in writing. Deleted data is removed so it cannot be read or rebuilt.
Personal data breaches
Anyone who suspects a breach reports it to the Data Protection Officer immediately. We contain it, assess the risk, and keep a record of what happened and what we did. When the law requires it, we notify the National Privacy Commission and the people affected within 72 hours of learning of the breach. When we act as a processor, we notify the client without delay so they can meet their own duties.
Requests from individuals
People can ask to access, correct, object to, erase or receive a copy of their information, and can withdraw consent at any time. We verify the request, then respond within 15 business days. If a request concerns data we process for a client, we pass it to that client promptly and help them respond.
Changes to this policy
We review this policy at least once a year and whenever our services or the law change. The date at the top shows the latest version.
Contact us
For questions about this policy, or to report a privacy concern, contact our Data Protection Officer at [email protected] with “Privacy request” in the subject line. You may also contact the National Privacy Commission at privacy.gov.ph.
Apollos Software Development Services, Philippines