Privacy Policy
1. Introduction
This Privacy Policy explains how Blackfish Solutions Inc. ("Blackfish", "we", "us") collects, uses, shares and protects personal information when you visit this website or contact us through it. It applies to this website only. Our products and services may be covered by separate agreements and notices.
We process personal information in line with the principles of transparency, legitimate purpose and proportionality set out in the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission, and with other privacy laws that apply to us.
Personal information controller: Blackfish Solutions Inc., [TO BE CONFIRMED: registered business address].
2. Information we collect
We collect only the information needed for the purposes described in this policy:
- Information you give us when you submit the contact form, as described in section 3.
- Technical information that your browser sends automatically when you load a web page, such as your IP address, browser type, the page requested and the date and time of the request. This is used to deliver the website, keep it secure and prevent abuse.
We do not use this website to collect sensitive personal information, such as government-issued identifiers, health information or financial account details. Please do not include such information in your message.
3. Information submitted through the contact form
When you use the contact form, we ask for:
- Your name
- Your company (optional)
- Your business email address
- The topic of your inquiry and your message
- Whether you would like to receive updates or marketing communications (optional, and off unless you tick the box)
To protect the form from spam and automated abuse, we also process your IP address and, where the security check is enabled, the result of an automated bot-detection check (see section 11). IP addresses used for rate limiting are stored only in a one-way hashed form and only for a short period.
Submitting the form is not conditional on agreeing to receive marketing communications.
4. How we use information
- To respond to your inquiry and, if you ask, to discuss or provide our products and services.
- To handle privacy and data-protection requests you send us.
- To operate, secure and maintain the website, including detecting and preventing spam, fraud and abuse.
- To send you occasional updates, news or marketing communications, only if you have opted in. You can withdraw that consent at any time.
- To comply with legal obligations and to establish, exercise or defend legal claims.
We do not sell personal information, and we do not use information from this website for automated decision-making that produces legal or similarly significant effects on you.
5. Legal and business purposes for processing
Depending on the purpose, we rely on one or more of the following grounds recognized under the Data Privacy Act and other applicable law:
- Steps you have asked us to take before entering into a contract, such as answering your inquiry or preparing an assessment or proposal.
- Our legitimate interests in responding to business inquiries, and in keeping this website and our systems secure, where those interests are not overridden by your rights and freedoms.
- Your consent, for optional marketing communications. You may withdraw consent at any time without affecting processing that took place before withdrawal.
- Compliance with legal obligations that apply to us.
[TO BE CONFIRMED: counsel to confirm the lawful criteria relied on for each purpose]
6. Data retention
We keep personal information only for as long as it is needed for the purposes for which it was collected, or as required by law, and then securely delete or anonymize it.
- Contact form inquiries: [TO BE CONFIRMED: retention period]
- Marketing preferences: until you withdraw consent, and then only as long as needed to respect that choice.
- Security and abuse-prevention records (hashed IP rate-limit counters): automatically deleted within 20 minutes; duplicate-submission markers within one hour.
8. Data security
We use organizational, physical and technical measures designed to protect personal information against loss, misuse and unauthorized access, disclosure or alteration. These include encrypted connections (HTTPS), validation and filtering of form submissions, rate limiting and access controls on the systems that receive inquiries. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
If a personal data breach occurs that is likely to put you at risk, we will notify you and the National Privacy Commission where required by law.
9. Your rights as a data subject
Subject to the conditions and limits set by law, you have the right to:
- Be informed whether and how your personal information is being processed.
- Access the personal information we hold about you.
- Object to processing, including processing for marketing.
- Correct inaccurate or incomplete personal information.
- Erasure or blocking of personal information that is no longer necessary or is processed unlawfully.
- Data portability, where applicable.
- Withdraw consent at any time, where processing is based on consent.
- Damages for harm caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.
- Lodge a complaint with the National Privacy Commission of the Philippines, or with the data protection authority where you live.
To exercise any of these rights, see section 15. We may need to verify your identity before acting on a request.
11. Third-party services
- Google Fonts. This website loads its typefaces from Google Fonts. When your browser requests the fonts, Google receives your IP address and standard request information. See Google's privacy policy for how Google handles this data.
- Cloudflare Turnstile. When the security check is enabled on the contact form, Cloudflare Turnstile processes technical signals from your browser and device to confirm that a person, not an automated program, is submitting the form. It is used only for security. See Cloudflare's privacy policy for details.
This website may link to other websites. We are not responsible for the privacy practices of websites we do not operate, and we encourage you to read their privacy policies.
12. International data transfers
Some of the service providers described in sections 7 and 11 may process information on servers located outside the Philippines. Where personal information is transferred internationally, we take steps to ensure it remains protected in line with the Data Privacy Act and other applicable law.
[TO BE CONFIRMED: countries involved and the safeguards relied on for international transfers]
13. Children's privacy
This website is intended for businesses and professionals. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.
14. Changes to this Privacy Policy
We may update this policy from time to time, for example when our practices or the law change. The updated version will be posted on this page with a new effective date. Where changes are significant, we will take reasonable steps to let you know.
15. Contact and privacy inquiries
To ask a question about this policy or to exercise your data subject rights, use our contact form and choose "Privacy or data-protection request" as the topic. Please tell us which right you wish to exercise and enough detail for us to locate your information.
Data Protection Officer: [TO BE CONFIRMED: Data Protection Officer designation and dedicated contact channel]